nginx.conf

server {
    listen ${PORT};
    server_name_in_redirect off;

    access_log  /var/log/nginx/access.log;
    error_log  /var/log/nginx/error.log debug;

    location / {
        proxy_pass ${PROXY};
        proxy_set_header Origin ${ORIGIN};


        # proxy_set_header is to set a request header
        # add_header is to add header to response
        # proxy_hide_header is to hide a response header

        proxy_hide_header Access-Control-Allow-Origin;  # Hide the existing header if defined
        add_header Access-Control-Allow-Origin ${CORS} always;
        add_header Access-Control-Allow-Methods 'POST, GET' always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header Access-Control-Max-Age: 86400 always;  # 60 * 60 * 24;
        add_header Access-Control-Allow-Headers: 'Origin, X-Requested-With, Content-Type, Accept, Authorization, X-Debug-Mode' always;

        if ($request_method = 'OPTIONS') {
            add_header 'Access-Control-Allow-Origin' ${CORS};
            add_header 'Access-Control-Allow-Methods' 'POST, GET' always;
            add_header 'Access-Control-Allow-Credentials' 'true' always;
            #
            # Custom headers and headers various browsers *should* be OK with but aren't
            #
            add_header 'Access-Control-Allow-Headers' 'Origin, X-Requested-With, Content-Type, Accept, Authorization, X-Debug-Mode' always;
            #
            # Tell client that this pre-flight info is valid for 20 days
            #
            add_header 'Access-Control-Max-Age' 86400;
            add_header 'Content-Type' 'text/plain; charset=utf-8';
            add_header 'Content-Length' 0;
            return 204;
        }
    }
}