invisible add_header 'Access-Control-Allow-Origin' "$http_origin" always; code example Example: access-control-allow-origin Access-Control-Allow-Origin: *