What should be the structure of nginx.conf with basic authorization and cors?

Question

Nginx

The application uses cross-domain requests and basic authorization. A config like this comes to mind:

server {
    location / {
        #CORS
        if ($request_method = OPTIONS ) {
            add_header Access-Control-Allow-Origin "http://localhost"; # <- needs to be updated
            add_header Access-Control-Allow-Methods "GET, OPTIONS";
            add_header Access-Control-Allow-Headers "Authorization";   # <- You may not need this...it's for Basic Auth
            add_header Access-Control-Allow-Credentials "true";        # <- Basic Auth stuff, again
            add_header Content-Length 0;
            add_header Content-Type text/plain;
            return 200;
        }


        #Authentification
        satisfy any;

        allow 123.456.789.001;
        allow 123.456.789.002;
        deny  all;
        
        auth_basic           "Admin section";
        auth_basic_user_file .htpasswd;


        #Routing
        location ~ ^/(images|javascripts|stylesheets|system)/  {
            root /some/directory/for/rails/app/public;
            expires max;
            break;
        }

        location ... {
            ...
        }
    }
}

I don't like having to wrap everything in `location /`. How to do it right? Can you share your configs?

Answer 1

Perhaps for the sake of history I will leave an example.
Headers will be Access-Control-Allow-*required in all types of requests. Therefore, they do not need to be segmented as on enable-cors.org
The need for a condition if ($request_method)at the location level, and not server, was related to the peculiarities of nginx.

server {

    #Authentification
    satisfy any;

    allow 123.456.789.001;
    allow 123.456.789.002;
    deny  all;
        
    auth_basic           "Admin section";
    auth_basic_user_file .htpasswd;

    #CORS
    add_header Access-Control-Allow-Origin "http://localhost"; # <- needs to be updated
    add_header Access-Control-Allow-Methods "GET, OPTIONS"; # 
    add_header Access-Control-Allow-Headers "Authorization";
    add_header Access-Control-Allow-Credentials "true"; 

    location / {
        if ($request_method = OPTIONS ) { # <- because if ($request_method) doesn't work on server level
            add_header Content-Length 0;
            add_header Content-Type text/plain;
            return 200;
        }
    }

    #Routing
    location ~ ^/(images|javascripts|stylesheets|system)/  {
         root /some/directory/for/rails/app/public;
         expires max;
        break;
    }

    location ... {
        ...
    }

}