I am trying to override the ‘Access-Control-Allow-Origin’ header defined in the NGINX configuration file. When I do this I see the ‘Access-Control-Allow-Origin’ header twice in the ‘response header’.

Chrome Dev tools will show:
Access to fetch at 'https://example.com/api/check' from origin 'http://localhost:1234' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'https://example.com, *', but only one is allowed. Have the server send the header with a valid value, or, if an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

I am looking for a way to overwrite the existing ‘Access-Control-Allow-Origin’ so that we can adjust this dynamically from Laravel. The current code I’m using is:
[code]

If I remove the ‘Access-Control-Allow-Origin’ header from NGINX, I get the following message:
Access to fetch at 'https://example.com/api/check' from origin 'http://localhost:1234' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No ' Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

NGINX Config:

#!/usr/bin/env bash

declare -A params=$6       # Create an associative array
declare -A headers=${9}    # Create an associative array
declare -A rewrites=${10}  # Create an associative array
paramsTXT=""
if [ -n "$6" ]; then
   for element in "${!params[@]}"
   do
      paramsTXT="${paramsTXT}
      fastcgi_param ${element} ${params[$element]};"
   done
fi
headersTXT=""
if [ -n "${9}" ]; then
   for element in "${!headers[@]}"
   do
      headersTXT="${headersTXT}
      add_header ${element} ${headers[$element]};"
   done
fi
rewritesTXT=""
if [ -n "${10}" ]; then
   for element in "${!rewrites[@]}"
   do
      rewritesTXT="${rewritesTXT}
      location ~ ${element} { if (!-f $request_filename) { return 301 ${rewrites[$element]}; } }"
   done
fi

if [ "$7" = "true" ]
then configureXhgui="
location /xhgui {
        try_files $uri $uri/ /xhgui/index.php?$args;
}
"
else configureXhgui=""
fi

block="server {
    listen ${3:-80};
    listen ${4:-443} ssl http2;
    server_name .$1;
    root "$2";

    index index.html index.htm index.php;

    charset utf-8;

    $rewritesTXT

    location / {
        try_files $uri $uri/ /index.php?$query_string;
        $headersTXT
    }

    location ^~ /mysocket {
        #your proxy directives
        proxy_pass http://127.0.0.1:1234;
        proxy_redirect off;
    
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
    
        proxy_set_header Host $http_host;
        proxy_set_header X-NginX-Proxy "false";
    
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        add_header Access-Control-Allow-Origin *;
    }

    $configureXhgui

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    access_log /var/log/nginx/livecloud.local-access.log;
    error_log  /var/log/nginx/$1-error.log error;

    sendfile off;

    location ~ .php$ {
        fastcgi_split_path_info ^(.+.php)(/.+)$;
        fastcgi_pass unix:/var/run/php/php$5-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        $paramsTXT

        fastcgi_intercept_errors off;
        fastcgi_buffer_size 16k;
        fastcgi_buffers 4 16k;
        fastcgi_connect_timeout 300;
        fastcgi_send_timeout 300;
        fastcgi_read_timeout 300;
    }

    location ~ /.ht {
        deny all;
    }

    # add_header Referrer-Policy "same-origin";
    add_header Access-Control-Allow-Origin *; 
    add_header Access-Control-Allow-Headers *; 
    
    ssl_certificate     /etc/ssl/certs/$1.crt;
    ssl_certificate_key /etc/ssl/certs/$1.key;
}
"

echo "$block" > "/etc/nginx/sites-available/$1"
ln -fs "/etc/nginx/sites-available/$1" "/etc/nginx/sites-enabled/$1"

Laravel middleware:

<?php

namespace AppHttpMiddleware;
use Closure;
use AppModelsWhiteLabelDomain;

class Cors 
{
    private $origins;

    public function __construct()
    {
        $this->origins = [
            'https://example.com'
        ]; 
    }

    /**
     * Handle an incoming request.
     *
     * @param  IlluminateHttpRequest  $request
     * @param  Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        $response = $next($request);
        $origin = $_SERVER['HTTP_ORIGIN'];

        if (in_array($origin, $this->origins)) {
            $response->header('Access-Control-Allow-Origin', $origin, true);
        }

        return $response;
    }
}