add_header 'Access-Control-Allow-Origin' 'https://xyz.test.top' always; add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always; add_header 'Access-Control-Allow-Headers' 'Origin, Content-Type, Accept, Authorization' always; add_header 'Access-Control-Allow-Credentials' 'true' always;