不同域名Nginx代理Grafana 9时面板提示“Origin not allowed”求助

问题背景 #

Grafana 9直接部署在domainA域名下，计划通过domainB域名搭建Nginx代理实现访问。按照社区帖子和官方文档配置Nginx后，虽能通过代理打开Grafana，但面板提示"Origin not allowed"，添加标准CORS响应头后问题仍未解决。

当前Nginx配置 #

# 用于代理Grafana Live WebSocket连接
map $http_upgrade $connection_upgrade {
  default upgrade;
  '' close;
}

upstream grafana {
  server domainA;
}

server {
  listen 8080;
  server_name domainB;


  location / {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host domainA;
    proxy_pass https://grafana-prj-sso-monitoring.apps.okd.svc.elca.ch;
  }

  # 代理Grafana Live WebSocket连接
  location /api/live/ {
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_set_header Host domainA;
    proxy_pass https://domainA;
  }
}

已添加的CORS头配置 #

add_header 'Access-Control-Allow-Origin' '*';
add_header 'Access-Control-Allow-Methods' 'GET, POST';
add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type';
add_header 'Access-Control-Allow-Credentials' 'true';

解决方案 #

1. 修正Grafana自身域名配置 #

Grafana会校验请求来源与配置的域名是否匹配，需修改grafana.ini配置文件：

[server]
root_url = https://domainB/
allow_embedding = true

[security]
allow_origin = https://domainB

如果用环境变量配置，对应设置：GF_SERVER_ROOT_URL=https://domainB/、GF_SERVER_ALLOW_EMBEDDING=true、GF_SECURITY_ALLOW_ORIGIN=https://domainB

2. 调整Nginx代理头设置 #

无需额外添加CORS头，重点修正代理传递的主机头和转发协议信息，确保Grafana能识别实际访问域名：

server {
  listen 8080;
  server_name domainB;

  location / {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header Host $host; # 改为代理域名domainB
    proxy_pass https://domainA;
  }

  location /api/live/ {
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header Host $host;
    proxy_pass https://domainA;
  }
}

核心原因：之前将Host头设为domainA，导致Grafana识别的请求域名和实际访问的domainB不匹配，触发跨域拦截；且Grafana会覆盖自定义添加的CORS头，所以额外加CORS规则无效。

3. 重启服务生效 #

• 重启Grafana服务加载新配置
• 重启Nginx应用代理规则变更

内容的提问来源于stack exchange，提问作者Nereis