title: CORS redirect from http to https
body: <p>Just found out that when you return 301 Redirect status from your server to a CORS request, <strong>the browser set the subsequent 'Origin' header to 'null'</strong>. Apparently this is for privacy reason, but I'm only referring from http to https in my nginx server! Oh well.. what can you do.</p>
  
  <p>On my nginx config for https, I am checking $http_origin before adding my CORS headers. Since the browser set the damn Origin header to 'null', the header didn't got added to the response.</p>
  
  <p>Is there anyway around this problem or I'm forced to just make sure my Origin client sends only https requests?</p>
  
  <p>Hope the question is not too broad.</p>