---
title: "TIL: Allowing CORS for specific subdomains with NGINX"
date: 2023-05-09T07:22:35
slug: til-allowing-cors-for-specific-subdomains-with-nginx

---
Here's a quick blog to add to an NGINX config to allow CORS for subdomains, without the wide-open policy you get when using `*`, taken from [this StackOverflow answer](https://serverfault.com/a/1045483):

```nginx
map $http_origin $allow_origin {
    ~^https?://(.*\.)?my.domain(:\d+)?$ $http_origin;
    default "";
}

server {
	listen 80;
	listen [::]:80;
	...
	
	add_header 'Access-Control-Allow-Origin' $allow_origin;
```
