[GH-ISSUE #379] Custom CORS

kerem commented

2026-02-26 06:32:15 +03:00

Owner

Originally created by @JonathanTreffler on GitHub (Apr 18, 2020).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/379

Is your feature request related to a problem? Please describe.
We all know CORS is a huge pain to set up. At least if you want to do it right and don't already have a working snippet to paste in.
I love this Proxy Manager, because it makes many things much more easy, but it makes CORS even worse.
I have been able to create a proxy host, that can handle preflight cors requests with a custom location (like in #202), but i still think there should be a way to set CORS with the GUI.
A GUI Option was mentioned in #202, but since that wasn't the original topic of the issue i created this issue dedicated to a gui solution.

Describe the solution you'd like
A GUI for CORS in the Advanced Tab, to control CORS like this:

Originally created by @JonathanTreffler on GitHub (Apr 18, 2020). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/379 **Is your feature request related to a problem? Please describe.** We all know CORS is a huge pain to set up. At least if you want to do it right and don't already have a working snippet to paste in. I love this Proxy Manager, because it makes many things much more easy, but it makes CORS even worse. I have been able to create a proxy host, that can handle preflight cors requests with a custom location (like in #202), but i still think there should be a way to set CORS with the GUI. A GUI Option was mentioned in #202, but since that wasn't the original topic of the issue i created this issue dedicated to a gui solution. **Describe the solution you'd like** A GUI for CORS in the Advanced Tab, to control CORS like this: ![image](https://user-images.githubusercontent.com/28999431/79633201-4e625000-8164-11ea-9c90-ac440d7af3b3.png)

kerem added the

enhancement

stale

labels

2026-02-26 06:32:15 +03:00

kerem commented

2026-02-26 06:32:16 +03:00

Author

Owner

@fturiot commented on GitHub (Feb 9, 2021):

hi,
actualy how change Access-Control-Allow-Origin ?

thanks

@fturiot commented on GitHub (Feb 9, 2021): hi, actualy how change Access-Control-Allow-Origin ? thanks

kerem commented

2026-02-26 06:32:16 +03:00

Author

Owner

@JonathanTreffler commented on GitHub (Feb 10, 2021):

actualy how change Access-Control-Allow-Origin ?

Thats not easy in my opinion, but take a look here #202

@JonathanTreffler commented on GitHub (Feb 10, 2021): > actualy how change Access-Control-Allow-Origin ? Thats not easy in my opinion, but take a look here #202

kerem commented

2026-02-26 06:32:16 +03:00

Author

Owner

@Na0mir commented on GitHub (Mar 25, 2021):

This would be awesome!

@Na0mir commented on GitHub (Mar 25, 2021): This would be awesome!

kerem commented

2026-02-26 06:32:16 +03:00

Author

Owner

@trdwll commented on GitHub (Jan 6, 2022):

@jc21 Any news on this? I think it could be a great small addition to the next release if you have the time.

@trdwll commented on GitHub (Jan 6, 2022): @jc21 Any news on this? I think it could be a great small addition to the next release if you have the time.

kerem commented

2026-02-26 06:32:16 +03:00

Author

Owner

@NathanPeake commented on GitHub (Apr 4, 2022):

this is really needed

@NathanPeake commented on GitHub (Apr 4, 2022): this is really needed

kerem commented

2026-02-26 06:32:16 +03:00

Author

Owner

@rallisf1 commented on GitHub (Aug 7, 2022):

Just want to share my working config for CORS as I spent quite a few hours to figure it out. I use the following on the advanced tab of the proxy host settings:

location ~ ^/THE-PATH-TO-PROTECT {
	more_set_headers 'Access-Control-Allow-Origin: https://YOUR-REQUEST-DOMAIN';
	more_set_headers 'Access-Control-Allow-Headers: Authorization';
	more_set_headers 'Access-Control-Allow-Credentials: true';
	more_set_headers 'Access-Control-Allow-Methods: GET,POST,OPTIONS,PUT,DELETE,PATCH';
	more_set_headers 'Access-Control-Allow-Headers: Authorization,Accept,Origin,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
	
	
    if ($request_method = 'OPTIONS') {
      more_set_headers 'Access-Control-Allow-Origin: https://YOUR-REQUEST-DOMAIN';
      more_set_headers 'Access-Control-Allow-Credentials: true';
      more_set_headers 'Access-Control-Allow-Headers: Authorization,Accept,Origin,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
      more_set_headers 'Access-Control-Allow-Methods: GET,POST,OPTIONS,PUT,DELETE,PATCH';
      more_set_headers 'Access-Control-Max-Age: 1728000';
      more_set_headers 'Content-Type: text/plain charset=UTF-8';
      more_set_headers 'Content-Length: 0';
      return 204;
    }

    include conf.d/include/proxy.conf;
}

Edit Nov/22: For some reason add_header stopped working a few weeks ago, more_set_headers did the trick.

@rallisf1 commented on GitHub (Aug 7, 2022): Just want to share my working config for CORS as I spent quite a few hours to figure it out. I use the following on the advanced tab of the proxy host settings: ``` location ~ ^/THE-PATH-TO-PROTECT { more_set_headers 'Access-Control-Allow-Origin: https://YOUR-REQUEST-DOMAIN'; more_set_headers 'Access-Control-Allow-Headers: Authorization'; more_set_headers 'Access-Control-Allow-Credentials: true'; more_set_headers 'Access-Control-Allow-Methods: GET,POST,OPTIONS,PUT,DELETE,PATCH'; more_set_headers 'Access-Control-Allow-Headers: Authorization,Accept,Origin,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range'; if ($request_method = 'OPTIONS') { more_set_headers 'Access-Control-Allow-Origin: https://YOUR-REQUEST-DOMAIN'; more_set_headers 'Access-Control-Allow-Credentials: true'; more_set_headers 'Access-Control-Allow-Headers: Authorization,Accept,Origin,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range'; more_set_headers 'Access-Control-Allow-Methods: GET,POST,OPTIONS,PUT,DELETE,PATCH'; more_set_headers 'Access-Control-Max-Age: 1728000'; more_set_headers 'Content-Type: text/plain charset=UTF-8'; more_set_headers 'Content-Length: 0'; return 204; } include conf.d/include/proxy.conf; } ``` Edit Nov/22: For some reason `add_header` stopped working a few weeks ago, `more_set_headers` did the trick.

kerem commented

2026-02-26 06:32:16 +03:00

Author

Owner

@Tharic99 commented on GitHub (Aug 17, 2022):

@rallisf1 Can you clarify more what location ~ ^/THE-PATH-TO-PROTECT { means?

Example: If my hosted domain is www.yahoo.com and I want to ensure that 192.168.x.x is allowed via CORS, I know I would replace YOUR-REQUEST-DOMAIN with www.yahoo.com, but does the 192.168.x.x go anywhere?

@Tharic99 commented on GitHub (Aug 17, 2022): @rallisf1 Can you clarify more what `location ~ ^/THE-PATH-TO-PROTECT {` means? Example: If my hosted domain is www.yahoo.com and I want to ensure that 192.168.x.x is allowed via CORS, I know I would replace YOUR-REQUEST-DOMAIN with www.yahoo.com, but does the 192.168.x.x go anywhere?

kerem commented

2026-02-26 06:32:16 +03:00

Author

Owner

@rallisf1 commented on GitHub (Aug 17, 2022):

@Tharic99 see the docs for location syntax. THE-PATH-TO-PROTECT is used if you want to use CORS just for a subfolder, the hosted domain is inherited from the server block.

YOUR-REQUEST-DOMAIN can be your IP address as long as that is used for the request. Check the error message in your browser console and use exactly the address that fails CORS. Also note that you can only allow 1 address (or IP) by default and cannot use wildcards. See here for a workaround.

@rallisf1 commented on GitHub (Aug 17, 2022): @Tharic99 see the [docs](http://nginx.org/en/docs/http/ngx_http_core_module.html#location) for location syntax. `THE-PATH-TO-PROTECT` is used if you want to use CORS just for a subfolder, the hosted domain is inherited from the server block. `YOUR-REQUEST-DOMAIN` can be your IP address as long as that is used for the request. Check the error message in your browser console and use exactly the address that fails CORS. Also note that you can only allow 1 address (or IP) by default and cannot use wildcards. See [here](https://stackoverflow.com/a/27879729) for a workaround.

kerem commented

2026-02-26 06:32:16 +03:00

Author

Owner

@luixal commented on GitHub (Oct 7, 2022):

Hi,

This comment from @rallisf1 just saved my day. Thanks man!

@luixal commented on GitHub (Oct 7, 2022): Hi, [This comment](https://github.com/NginxProxyManager/nginx-proxy-manager/issues/379#issuecomment-1207363141) from @rallisf1 just saved my day. Thanks man!

kerem commented

2026-02-26 06:32:16 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Mar 30, 2024):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Mar 30, 2024): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem commented

2026-02-26 06:32:16 +03:00

Author

Owner

@dimo414 commented on GitHub (Mar 30, 2024):

Stalebot go away.

@dimo414 commented on GitHub (Mar 30, 2024): Stalebot go away.

kerem commented

2026-02-26 06:32:16 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Dec 21, 2024):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Dec 21, 2024): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem commented

2026-02-26 06:32:16 +03:00

Author

Owner

@NathanPeake commented on GitHub (Dec 21, 2024):

not stale

@NathanPeake commented on GitHub (Dec 21, 2024): not stale

kerem commented

2026-02-26 06:32:16 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Nov 12, 2025):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Nov 12, 2025): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem referenced this issue

2026-02-26 07:38:29 +03:00

[PR #319] [MERGED] v2.2.0 New Brand #3214

Rows
Columns

[GH-ISSUE #379] Custom CORS #319