nginx.conf

events {}
http {
    include mime.types;

    map_hash_bucket_size 128;
    
    map $http_origin $cors_origin {
        default "";
        "~^https?://localhost(:[0-9]+)?$" "$http_origin";
        "https://staging.pawplanner.052024-jaune-2.wns.wilders.dev" "$http_origin";
        "https://pawplanner.052024-jaune-2.wns.wilders.dev" "$http_origin";
    }
    
    server {
        listen 80;
        
        location /graphql {
            proxy_pass http://server:3200;
            
            # OPTIONS request
            if ($request_method = 'OPTIONS') {
                add_header 'Access-Control-Allow-Origin' $cors_origin;
                add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE, PATCH';
                add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization';
                add_header 'Access-Control-Max-Age' 1728000;
                add_header 'Content-Type' 'text/plain charset=UTF-8';
                add_header 'Content-Length' 0;
                return 204;
            }
            
            # Other requests
            add_header 'Access-Control-Allow-Origin' $cors_origin always;
            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE, PATCH' always;
            add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
            add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always;
        }
        
        location / {
            root /web-client-build;
            try_files $uri /index.html;
            add_header 'Access-Control-Allow-Origin' $cors_origin always;
        }
    }
}

## https://enable-cors.org/server_nginx.html
## https://www.apollographql.com/docs/apollo-server/security/cors