title: No 'Access-Control-Allow-Origin' when tls enabled in ingress nginx
body: <p>I know that it seems that my question has a lot of answers already but bear with me.</p>
  <p>I have a Django application running on k8s cluster with nginx ingress setup with letsencrypt staging tls certificate (the problem occurs with production certificate also).</p>
  <p>I don't know if it matters but application uses <code>Basic Authentication</code> to authorize users which is setup with <code>drf</code> build-in authentication system.</p>
  <p>I've setup CORS as follows:</p>
  <pre><code>### ingress.yaml
  
  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    name: app-routing
    annotations:
      kubernetes.io/ingress.class: &quot;nginx&quot;
      cert-manager.io/cluster-issuer: &quot;letsencrypt-staging&quot;
      nginx.ingress.kubernetes.io/enable-cors: &quot;true&quot;
      nginx.ingress.kubernetes.io/cors-allow-methods: &quot;PUT, GET, POST, PATCH, OPTIONS&quot;
      nginx.ingress.kubernetes.io/cors-allow-origin: &quot;https://example.com&quot;
      nginx.ingress.kubernetes.io/cors-allow-credentials: &quot;true&quot;
      nginx.ingress.kubernetes.io/cors-allow-headers: &quot;DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,X-CSRFToken&quot;
  spec:
    tls:
    - hosts:
        - api.example.com
      secretName: app-ingress-tls
    rules:
      - host: api.example.com
        http:
          paths:
            - path: /
              backend:
                serviceName: service-backend
                servicePort: 80
  </code></pre>
  <p>and in Django application:</p>
  <pre><code>### settings.py
  ...
  MIDDLEWARE = [
      'django.middleware.security.SecurityMiddleware',
      'django.contrib.sessions.middleware.SessionMiddleware',
      'corsheaders.middleware.CorsMiddleware',
      'django.middleware.common.CommonMiddleware',
      'django.middleware.csrf.CsrfViewMiddleware',
      'django.contrib.auth.middleware.AuthenticationMiddleware',
      'django.contrib.messages.middleware.MessageMiddleware',
      'django.middleware.clickjacking.XFrameOptionsMiddleware',
  ]
  
  CORS_ORIGIN_ALLOW_ALL = True
  # I also tried setting:
  # CORS_ORIGIN_WHITELIST = [
  #     &quot;https://example.com&quot;,
  #     &quot;https://www.example.com&quot;
  # ]
  #
  
  REST_FRAMEWORK = {
      'DEFAULT_AUTHENTICATION_CLASSES': [
          'rest_framework.authentication.BasicAuthentication'
      ],
  }
  
  ...
  </code></pre>
  <p>But still when I send request from my frontend app I'm getting error</p>
  <pre><code>Access to XMLHttpRequest at 'https://api.example.com/somepath' from origin 'https://example.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
  </code></pre>
  <p>The weird thing is that when I disable tls in ingress the issue is gone. Tho with tls enabled, if I send request using postman or <code>curl</code> like that:</p>
  <p><code>curl -i -k -H &quot;Authorization: Basic token&quot; https://api.example.com/somepath</code></p>
  <p>I'm getting response with headers as expected:</p>
  <pre><code>HTTP/2 200
  server: nginx/1.17.7
  date: Mon, 06 Jul 2020 18:58:50 GMT
  content-type: application/json
  content-length: 9
  vary: Accept, Origin
  allow: GET, HEAD, OPTIONS
  x-frame-options: DENY
  x-content-type-options: nosniff
  strict-transport-security: max-age=15724800; includeSubDomains
  access-control-allow-origin: https://example.com
  access-control-allow-credentials: true
  access-control-allow-methods: PUT, GET, POST, PATCH, OPTIONS
  access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,X-CSRFToken
  </code></pre>
  <p>I presume that headers are there because ingress itself added them (?)</p>
  <p>I'm pretty new to whole devops world so I would appreciate any tip on where to look or what to check. Most of answers to this questions suggests to properly set <code>CORS_ORIGIN_ALLOW_ALL</code> and/or <code>CORS_ORIGIN_WHITELIST</code> which I already tried.</p>