# specifically, this example allow CORS requests from
#  scheme    : http or https
#  authority : any authority ending in ".mckinsey.com"
#  port      : nothing, or :
if ($http_origin ~* (https?://[^/]*\.(pingcap.com|pingcap.org)\.com(:[0-9]+)?)$) {
    set $cors "true";
}

# Nginx doesn't support nested If statements, so we use string
# concatenation to create a flag for compound conditions

# OPTIONS indicates a CORS pre-flight request
if ($request_method = 'OPTIONS') {
    set $cors "${cors}options";
}

# if it's a GET, PUT, DELETE or POST, set the standard CORS responses header
if ($cors = "true") {
    # Tells the browser this origin may make cross-origin requests
    # (Here, we echo the requesting origin, which matched the whitelist.)
    add_header 'Access-Control-Allow-Origin' "$http_origin";
    # Tells the browser it may show the response, when XmlHttpRequest.withCredentials=true.
    add_header 'Access-Control-Allow-Credentials' 'true';
}

# if it's OPTIONS, then it's a CORS preflight request so respond immediately with no response body
if ($cors = "trueoptions") {
    # Tells the browser this origin may make cross-origin requests
    # (Here, we echo the requesting origin, which matched the whitelist.)
    add_header 'Access-Control-Allow-Origin' "$http_origin";
    # in a preflight response, tells browser the subsequent actual request can include user credentials (e.g., cookies)
    add_header 'Access-Control-Allow-Credentials' 'true';

    add_header 'Access-Control-Max-Age' 1728000;

    add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';

    add_header 'Access-Control-Allow-Headers' 'Authorization,Content-Length,Content-Type,Cookie,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since,Accept-Encoding,Host,Referer';

    # build entire response to the preflight request
    # no body in this response
    add_header 'Content-Length' 0;
    # (should not be necessary, but included for non-conforming browsers)
    add_header 'Content-Type' 'text/plain charset=UTF-8';
    # indicate successful return with no content
    return 204;
}