CORS configuration in Nginx - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to allow all origins in CORS.

Nginx

add_header Access-Control-Allow-Origin [1];

Drag options to blanks, or click blank then click option'

A"https://example.com"

B"localhost"

C"*"

D"null"

Attempts:

3 left

💡 Hint

Common Mistakes

Using a specific domain instead of wildcard

Missing quotes around the value

The wildcard "*" allows all origins to access the resource.

2fill in blank

medium

Complete the code to allow only GET and POST methods in CORS.

Nginx

add_header Access-Control-Allow-Methods [1];

Drag options to blanks, or click blank then click option'

A"OPTIONS"

B"GET, POST"

C"PUT, PATCH"

D"GET, POST, DELETE"

Attempts:

3 left

💡 Hint

Common Mistakes

Including methods not allowed

Missing quotes around the methods

Only GET and POST methods are allowed by specifying them as a comma-separated string.

3fill in blank

hard

Fix the error in the code to allow credentials in CORS.

Nginx

add_header Access-Control-Allow-Credentials [1];

Drag options to blanks, or click blank then click option'

A"true"

Btrue

Cyes

D"yes"

Attempts:

3 left

💡 Hint

Common Mistakes

Using unquoted true

Using yes instead of true

The value must be the string "true" with quotes to enable credentials.

4fill in blank

hard

Fill both blanks to allow headers and methods in CORS.

Nginx

add_header Access-Control-Allow-Headers [1];
add_header Access-Control-Allow-Methods [2];

Drag options to blanks, or click blank then click option'

A"Content-Type, Authorization"

B"X-Custom-Header"

C"GET, POST, OPTIONS"

D"DELETE, PUT"

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing headers and methods

Missing quotes around values

The first header allows common headers like Content-Type and Authorization.
The second header allows GET, POST, and OPTIONS methods.

5fill in blank

hard

Fill all three blanks to configure CORS for origin, methods, and headers.

Nginx

add_header Access-Control-Allow-Origin [1];
add_header Access-Control-Allow-Methods [2];
add_header Access-Control-Allow-Headers [3];

Drag options to blanks, or click blank then click option'

A"https://mydomain.com"

B"GET, POST, OPTIONS"

C"Content-Type, Authorization"

D"*"

Attempts:

3 left

💡 Hint

Common Mistakes

Using wildcard for origin when specific domain is needed

Mixing headers and methods

This configuration allows only the specified origin, common HTTP methods, and common headers.