In my pub/static folder I can see that most themes are serving HTML files.

However, these are not specifically handled in the Nginx configuration file. When serving the full folder from CDN I get CORS issues.

Is it a good idea to allow CORS on HTML files?

add_header 'Access-Control-Allow-Origin' '*' 'always';

Or should I add behavior in my CDN that excludes *.html from being cached in the CDN?

  • what do you think yourself? what is better for security and your shop?
    – MagenX
    Commented Aug 30, 2019 at 8:07
  • Well I don’t know what security risk there is in allowing Cors on html, however I understand the benefits of caching) Commented Aug 31, 2019 at 3:05

1 Answer 1


did you know you can replace '*' with your origin?

map $http_origin $cors_header {
default "";
"~^(www)?\.yourdomain\.com" "$http_origin";
  • Thanks. I have a CNAME record for my CdN. Should I put the CNAME or the real origin? Commented Aug 31, 2019 at 6:56
  • If you have a new question, please ask it by clicking the Ask Question button. Include a link to this question if it helps provide context. - From Review
    – Jarnail S
    Commented Aug 31, 2019 at 7:13
  • @Jai hm your comment confusing
    – MagenX
    Commented Aug 31, 2019 at 9:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.