How to set up Nginx behind a Digital Ocean Load Balancer with SSL Termination

Posted on July 14, 2021

Hi there,

I have set up a load balancer with SSL termination. Behind this I have set up an Node Express server using NGinx as a reverse proxy to allow traffic from port 80 to redirect to my Express server running on port 4000. I have set this up using the NGINXConfig tool, config found here

When I visit the website on my frontend however (https://mydomain.net), the request to my express server (https://api.mydomain.net) is blocked by CORS, specifically:

Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

Oddly, when I had this set up with HTTPS between my NGinx proxy and the loadbalancer (without SSL Termination on the load balancer) this worked fine and I did not see CORS errors.

I assume this is down to the /etc/nginx/nginxconfig.io/security.conf file created by the NGINXConfig tool and the fact that the connection goes from HTTPS to HTTP, however I do not know what the correct secure config here should be and was wondering if anyone could help out?

Thanks

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Bobby

July 15, 2021

Hi there,

There are a few things that I could suggest:

As you are using express, there are CORS modules available that’ll ensure preflight responses are correct as well as actual responses. Like this one here:

https://www.npmjs.com/package/cors-anywhere

In your API you could add the following headers:

response.setHeader("Access-Control-Allow-Origin", "*");
response.setHeader("Access-Control-Allow-Credentials", "true");
response.setHeader("Access-Control-Allow-Methods", "GET,HEAD,OPTIONS,POST,PUT");
response.setHeader("Access-Control-Allow-Headers", "Access-Control-Allow-Headers, Origin,Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers");