nginx configuration for CORS (Cross-Origin Resource Sharing), with an origin whitelist, and HTTP Basic Access authentication allowed

nginx-cors.conf

# A CORS (Cross-Origin Resouce Sharing) config for nginx
# see details at https://gist.github.com/himyouten/df57b21958fba9c75ea7

if ($http_origin ~* (https?://.*\.garbagepla\.net(:[0-9]+)?)) {
  rewrite ^ /__cors__/$request_method$uri last;
}

location /__cors__/GET/ {
  add_header 'Access-Control-Allow-Origin' "$http_origin";
  add_header 'Access-Control-Allow-Credentials' 'true';
  # add_header 'Access-Control-Expose-Headers' 'customresponseheader';

  rewrite ^/__cors__/GET/(.*)$ /$1 last;
}

location /__cors__/POST/ {
  add_header 'Access-Control-Allow-Origin' "$http_origin";
  add_header 'Access-Control-Allow-Credentials' 'true';
  # add_header 'Access-Control-Expose-Headers' 'cutomresponseheader';
  rewrite ^/__cors__/POST/(.*)$ /$1 last;
}

location /__cors__/OPTIONS/ {
  add_header 'Access-Control-Allow-Origin' "$http_origin";
  add_header 'Access-Control-Allow-Credentials' 'true';
  add_header 'Access-Control-Max-Age' 1728000;
  add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
  add_header 'Access-Control-Allow-Headers' 'Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since';
  add_header 'Content-Length' 0;
  add_header 'Content-Type' 'text/plain charset=UTF-8';
  return 204;
}