How to allow multiple origins in Access-Control-Allow-Origin (CORS)

The header can hold only one origin (or *). To allow several sites, check the request's Origin against a list and send back that one origin.

1. Why a list doesn't work

We sent Access-Control-Allow-Origin: http://localhost:8965, http://127.0.0.1:8966 and called the API from both pages in Chrome: both were blocked. The browser wants exactly one origin, or *.

2. nginx: echo the origin from an allow-list

map $http_origin $cors_origin {
    default "";
    "https://app.example.com"   $http_origin;
    "https://admin.example.com" $http_origin;
    "~^http://localhost(:[0-9]+)?$" $http_origin;
}

server {
    listen 80;
    location /api/ {
        add_header Access-Control-Allow-Origin $cors_origin always;
        add_header Vary Origin always;
        if ($request_method = OPTIONS) {
            add_header Access-Control-Allow-Origin $cors_origin always;
            add_header Vary Origin always;
            add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
            add_header Access-Control-Allow-Headers "Authorization, Content-Type" always;
            add_header Access-Control-Max-Age 600 always;
            return 204;
        }
        return 200 '{"ok":true}\n';
    }
}

How it works: map compares the request's Origin with the list and sets $cors_origin to that origin, or to an empty string. nginx doesn't send a header whose value is empty, so other sites get no CORS header and the browser blocks them. Vary: Origin stops caches from serving one site's answer to another. The OPTIONS branch answers preflight requests (sent before PUT/DELETE or requests with an Authorization or JSON Content-Type header). Inside if, the add_header lines are repeated on purpose: nginx doesn't inherit outer add_header lines into a block that has its own.

3. What we tested

4. Mistakes to avoid

• Unanchored patterns. A rule like "~localhost" also matched http://localhost.evil.com in our test. Anchor every regex with ^ and $, and escape dots (\.) if you match domains with a regex.
• Echoing any origin. Sending back whatever Origin arrives is the same as *, but it also works with cookies. Never do that for an API that uses cookies or logins.
• Allowing null. Sandboxed iframes and local files send Origin: null, so anyone can produce it. Keep it out of the list.
• Cookies with *. Browsers reject * for credentialed requests. List the origins and add Access-Control-Allow-Credentials: true.

Check a response with curl -sI -H 'Origin: https://app.example.com' https://api.your-site.com/. To see the headers a page gets in the browser, use DevTools → Network → the request → Headers.

Written with AI assistance. The nginx config was run in nginx:alpine 1.31.6 on 2026-10-01; every 'allowed' / 'blocked' result is a real fetch() from Chromium 153 on two different origins. PlainHeaders is our extension; the other methods are free.