title: CORS problems in microservices architecture
body: <p>After a lot of searches and tries, I have decided to post my problems around CORS.</p>
  
  <p><strong>Context</strong></p>
  
  <p>I have a web site on a local server (NGINX), located on a PI. My web site deals with a microservice through REST API. </p>
  
  <p>My PI is behind my Freebox (French internet box), which redirect a specific port (ex : 28800) to the local @ of my pi. FYI, I don't have (and don't want) a fixed IP. And I share my IP with others users. So, I have a range of ports between 20000 and 30000 (approximatively).</p>
  
  <p>And I have a NO-IP hostname, pointed on my freebox IP completed with the specifc port. </p>
  
  <p><em>To resume:</em> 
  User -> mysite.no-ip.com ---(Translation NO-IP)---> 91.123.456.678:specifcport ---- (Redirect to my pi) ---> 192.168.0.30:80----(nginx)--->index.html</p>
  
  <p><strong>What I can do:</strong></p>
  
  <p>In my nginx site conf, I set a location /core. 
  When I do 
  mysite.no-ip.com/core/blabla, I well obtain the blabla treatment. 
  No problem!!</p>
  
  <p><strong>Here is my problem:</strong></p>
  
  <p>When I click on the button which launches the blabla action (throught an AJAX POST on mysite.no-ip.comm/core/blabla), I get a CORS failure. </p>
  
  <p>I have tried to modify my nginx configuration, adding headers depends of OPTIONS/GET/POST request type. Nothing appends. </p>
  
  <p>But, I find that my nginx is never touched by the request /core/blabla if this one is send by button. I have a CORS answer thrown by an APACHE Server. And I didn't install any APACHE Server. So, perhaps, it's a server hidden in my Freebox? Don't know how to set it to allow CORS request.</p>
  
  <p>Here is a snippet of my nginx config file </p>
  
  <pre><code>  server {
      listen 80;
      server_name mysite.no-ip.com
  
      location / {
      alias /path/to/root/production/folder/here;
      }
  
      location /core/ {
          if ($request_method = 'OPTIONS') {
              add_header 'Access-Control-Allow-Origin' '*';
              add_header 'Access-Control-Allow-Credentials' 'true';
              add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
              add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
              add_header 'Access-Control-Max-Age' 1728000;
              add_header 'Content-Type' 'text/plain charset=UTF-8';
              add_header 'Content-Length' 0;
              return 204;
          }  
          if ($request_method = 'POST') { 
              add_header 'Access-Control-Allow-Origin' '*';
              add_header 'Access-Control-Allow-Credentials' 'true';
              add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
              add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
         }
  
        proxy_pass http://localhost:8002/;
        }
   }
  </code></pre>
  
  <p>Thank you for your help.</p>