How do I need to modify my nginx header to allow api requests from another domain?

Viewed 42

I'm using pterodactyl on panel.server.com to host some game servers. My goal is to send a fetch request from server.com to panel.server.com using the ptercodactyl api. In this example I'm using the change power state.

I can send the following curl request totally fine.

curl "https://panel.server.com/api/client/servers/server-id/power" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer apikey' \
  -X POST \
  -d '{
  "signal": "start"
}'

My fetch request on server.com looks like this: https://pastebin.com/qhuqTMsw with "_url" being the URL above and "_apikey" being the client api key.

Now when I try to send this request I get

The 'Access-Control-Allow-Origin' header contains the invalid value ''.

as it already contains a Access-Control-Allow-Origin header with value ''.

I modified the header in nginx using

 add_header Access-Control-Allow-Origin *;

which does not working as it creates another Access-Control-Allow-Origin header and it'd contain two values. (e.g. ', *'). So I had to remove the existing "empty" header and add a new one using

location /api/client {
        proxy_hide_header 'Access-Control-Allow-Origin';
        add_header 'Access-Control-Allow-Origin' '*' always;
    }

This is my modified nginx config: https://pastebin.com/AuiWQhu2 I basically just added the location /api/client part.

Now - using fetch - the Access-Control-Allow-Origin header looks correct but the request results in

Response to preflight request doesn't pass access control check: It does not have HTTP ok status.

and is sending a 405 error . Also in pterodactyl (panel.server.com) I can not see any of my servers as the GET request https://panel.server.com/api/client?page=1 fails with

Request failed with status code 404

How do I have to modify my nginx header to allow CORS requests and being able to send a FETCH POST / GET from server.com without breaking the pterodactyl ui? I tried asking on the pterodactyl discord without any success.

Anyone willing to help me out?

Edit: I was able to resolve this issue by adding

try_files $uri $uri/ /index.php?$query_string;

to the location /api/client.

0 Answers
Related