Disable authentication for HTTP OPTIONS method (preflight request) in Nginx

Here's the solution I came up with. It insolves duplicating all the CORS add_header directives though.

location /api/ { proxy_pass http://127.0.0.1:14000; proxy_set_header Host $host; add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"; add_header Access-Control-Allow-Origin $http_origin; add_header Access-Control-Allow-Headers "Authorization, Content-Type"; add_header Access-Control-Allow-Credentials true; if ($request_method = OPTIONS) { add_header Content-Length 0; add_header Content-Type text/plain; add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"; add_header Access-Control-Allow-Origin $http_origin; add_header Access-Control-Allow-Headers "Authorization, Content-Type"; add_header Access-Control-Allow-Credentials true; return 200; } auth_basic "Restricted Area"; auth_basic_user_file /var/www/admin.htpasswd; } 

I found a cleaner solution which lets node manage the request:

Put the following configuration inside "location" and remove any auth_basic from server. This will work.

 location / { # Your node proxy configuration for example # # Make options requests work # limit_except OPTIONS { auth_basic "Restricted access zone"; auth_basic_user_file /etc/nginx/pass/protected; } } 

Following information at limit_except/if blocks problems, I'd suggest using map:

map $request_method $auth_basic_value { default "Restricted"; "OPTIONS" "off"; } location / { auth_basic $auth_basic_value; } 

Keep in mind, that if you have some try_files in that location, that may rewrite the query to another location, then you may also need to set auth_basic $auth_basic_value.