I have an Angular app whose build I am trying to run on an nginx docker container accessible at http://localhost:4001/. All 4001 resources load correctly, but the javascript bundle makes an xhr request to https:localhost:5001/foo/bar (note port and scheme change) that is blocked by firefox (“CORS failed”): a dotnet core app hosted in another docker container.

Here’s the nginx config, with everything opened up for local testing.

# Config file for nginx docker container for local development. Not used for production releases.
events{}
http {
    include /etc/nginx/mime.types;
    server {
        listen 4001;
        server_name localhost;
        root /usr/share/nginx/html;
        index index.html;
        location ~ /* {
            add_header 'Access-Control-Allow-Origin' '*' always;
            add_header 'Access-Control-Allow-Credentials' '*' always;
            add_header 'Access-Control-Allow-Methods' 'GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH' always;
            add_header 'Access-Control-Allow-Headers' 'Accept, Accept-Language, Content-Language, Content-Type, Authorization, Origin, Referer, User-Agent, Cache-Control, DNT, If-Modified-Since, Range' always;
            add_header 'Access-Control-Expose-Headers' '*' always;
            if ($request_method = 'OPTIONS' ) {
                return 204 no-content;
            }
            try_files $uri $uri/ =404;
        }
    }
}

I have verified that the headers are present on the response to http://localhost:4001/ and the js bundle http://localhost:4001/polyfills.js (in particular, the following are copied from the raw response):

Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: *
Access-Control-Allow-Methods: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Authorization, Origin, Referer, User-Agent, Cache-Control, DNT, If-Modified-Since, Range
Access-Control-Expose-Headers: *

Clearly the headers returned by http://localhost:4001/ aren’t allowing the script loaded by that page to call https://localhost:5001/foo/bar; why not, and what do I change to allow this xhr call?