title: Tornado + nginx CORS cookies
body: <p>I have Tornado app, working as an API server, that processes requests from several other sites. I also plan to use nginx as load balancer.</p>
  
  <p>The problem is CORS cookies. When someone is visiting partner site, <code>partner.com</code>, for example, JS script from there sends several requests to my server. The first request is aimed to set several cookies. But it doesnt.</p>
  
  <p>What i have:</p>
  
  <ol>
  <li>No header settings on tornado</li>
  <li><p>The following config on nginx</p>
  
  <pre><code>access_log /var/log/nginx/api_access.log;
  error_log /var/log/nginx/api_error.log;
  
  add_header Access-Control-Allow-Origin http://salesmarine.ru;
  add_header Access-Control-Allow-Credentials 'true';
  add_header Set-Cookie test=111;
  
  location / {
      proxy_pass_header Server;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Scheme $scheme;
      proxy_pass http://api;
      proxy_next_upstream error;
  }
  </code></pre></li>
  <li><p>All requests from JS are sent with <code>.withCredentials=true;</code> option
  Here are the request data:</p>
  
  <pre><code>Accept:*/*
  Accept-Encoding:gzip,deflate,sdch
  Accept-Language:ru-RU,ru;q=0.8,en-US;q=0.6,en;q=0.4
  Cache-Control:max-age=0
  Connection:keep-alive
  Content-Type:application/x-www-form-urlencoded
  Cookie:t_id=d9ed7601a2074e78b5ba38ab58ad7043; t_id_session=0c7910f9b3194e899d233e68380df59f;                 test=111
  Host:server.com
  If-None-Match:"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f"
  Origin:http://example.com
  Referer:http://example.com/test
  User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko)         Chrome/37.0.2062.120 Safari/537.36
  Query String Parametersview sourceview URL encoded
  id:54129700102392342dff6dbe
  apiKey:2a8bb0a06bca4ad59c4d4079dce30a30
  client_id:54129700102392342dff6dbe
  apikey:2a8bb0a06bca4ad59c4d4079dce30a30
  user_id:null
  Response Headersview source
  Access-Control-Allow-Credentials:true
  Access-Control-Allow-Origin:http://example.com
  Connection:keep-alive
  Date:Fri, 12 Sep 2014 19:40:17 GMT
  Etag:"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f"
  Mime-Type:text/javascript
  Server:TornadoServer/4.0.2
  Set-Cookie:test=111
  </code></pre></li>
  </ol>
  
  <p>And no cookies are sent. What could be the problem?</p>
  
  <p>And also what is better — control headers from tornado, or nginx?</p>