配置Nginx CORS头仍遇跨域错误：Access-Control-Allow-Header多值异常

我在/etc/hosts中将内部IP 192.168.1.119映射为multiserver.billinghub.net：

• 使用域名访问http://multiserver.billinghub.net/test/customer-portal时，内部调用同域名的http://multiserver.billinghub.net/jbilling/api/authentication/authenticate接口，浏览器因同域未拦截XHR请求；
• 但使用IP地址http://192.168.1.119/test/customer-portal访问时，内部调用域名接口被视为跨域请求，遭浏览器拦截。

我采用Nginx作为反向代理，添加了CORS响应头，但仍出现跨域错误，且Access-Control-Allow-Header存在多个值。以下是我的Nginx配置：

upstream customer-portal {
  random two least_conn;
  server 192.168.1.119:8087;
  server 192.168.1.113:8087;
  keepalive 4;
}

upstream jbilling {
  hash $binary_remote_addr consistent;
  server 192.168.1.119:8080;
  server 192.168.1.113:8080;
  keepalive 4;
}

map $http_origin $cors_origin_header {
    default "";
    "~(^|^http:\/\/)(localhost$|localhost:[0-9]{1,4}$)" "$http_origin";
    "http://multiserver.billinghub.net" "$http_origin"; 
    "http://192.168.1.119" "$http_origin";
}

map $http_origin $cors_cred {
    default "";
    "~(^|^http:\/\/)(localhost$|localhost:[0-9]{1,4}$)" "true";
    "http://multiserver.billinghub.net" "true"; 
    "http://192.168.1.119" "true";
}

## Server block with port and redirect config
server {

  listen 80 reuseport; 
  server_name multiserver.billinghub.net; 
  gzip on;
  gzip_types application/xml;
  gzip_min_length 1000;


  add_header 'Access-Control-Allow-Origin' '$cors_origin_header' always;
  add_header 'Access-Control-Allow-Credentials' '$cors_cred' always;
  add_header 'Access-Control-Allow-Methods' "GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH" always;
  add_header 'Access-Control-Allow-Headers' "Accept, Accept-Language, Content-Language, Content-Type, authorization, Origin, Referer, User-Agent, Cache-Control, DNT, If-Modified-Since, Cache-Control, Range, Uuid" always;
  add_header 'Access-Control-Expose-Headers' '*' always;
  
  if ($request_method = 'OPTIONS' ) {
      return 204 no-content;
  }

location /test/customer-portal {
    proxy_set_header        Host $host:$server_port;
    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        X-Forwarded-Proto $scheme;

    proxy_pass              http://customer-portal;

    # Required for new HTTP-based CLI
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    proxy_request_buffering off;
    proxy_buffering off; # Required for HTTP-based CLI to work over SSL
    # set client body size to 2M #
    client_max_body_size 500M;    
  }

  location /jbilling {
    proxy_set_header        Host $host:$server_port;
    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        X-Forwarded-Proto $scheme;

    proxy_pass              http://jbilling;

    # Required for new HTTP-based CLI
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    proxy_request_buffering off;
    proxy_buffering off; # Required for HTTP-based CLI to work over SSL
    # set client body size to 2M #
    client_max_body_size 500M;
  }
}

请问我遗漏了什么配置？

1. 缺少IP对应的server_name配置 #

当前Nginx server块的server_name仅设置为multiserver.billinghub.net，当用户用http://192.168.1.119访问时，请求会匹配到默认server块（如果存在），而非当前配置的server块，导致CORS头未正确添加。

修复方式：修改server_name，添加IP地址：

server_name multiserver.billinghub.net 192.168.1.119;

2. Access-Control-Allow-Headers存在重复值 #

配置中Access-Control-Allow-Headers重复声明了Cache-Control，会导致浏览器解析异常，需要去重：

add_header 'Access-Control-Allow-Headers' "Accept, Accept-Language, Content-Language, Content-Type, authorization, Origin, Referer, User-Agent, Cache-Control, DNT, If-Modified-Since, Range, Uuid" always;

3. OPTIONS请求CORS头处理不严谨 #

当前if ($request_method = 'OPTIONS')直接返回204，虽使用了always参数确保头存在，但部分场景下Nginx在return时可能无法正确携带头。可调整为直接在OPTIONS分支中显式添加CORS头：

if ($request_method = 'OPTIONS') {
    add_header 'Access-Control-Allow-Origin' '$cors_origin_header';
    add_header 'Access-Control-Allow-Credentials' '$cors_cred';
    add_header 'Access-Control-Allow-Methods' "GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH";
    add_header 'Access-Control-Allow-Headers' "Accept, Accept-Language, Content-Language, Content-Type, authorization, Origin, Referer, User-Agent, Cache-Control, DNT, If-Modified-Since, Range, Uuid";
    return 204;
}

4. 跨域场景下的Origin匹配验证 #

你的map配置已包含http://192.168.1.119，但前提是请求能进入当前server块，因此第一步修改server_name是核心前提，确保IP访问的请求能触发正确的CORS头逻辑。

内容的提问来源于stack exchange，提问作者Kainix