jquery ajax nginx 解决跨域问题

Question

我使用html+js+jquery 画了一个界面， 主要功能上传个excel，在js中解析，然后调用第三方的url接口，去提交一些数据。
因为用了ajax （post+json），直接调用会造成跨域，所以想利用nginx来理解，但是奇怪的是，我用页面去提交的时候总是会报403，但是利用postman确实正常的。。

ajax代码:
$.ajax({
type: "POST",
url: '/cambridge/api/ddSurvey/submit',
// url: 'https://mms.pinduoduo.com/cambridge/api/ddSurvey/submit',
// headers: { "X-CSRFtoken": $.cookie("csrftoken")},
async: true,
contentType: "application/json",
// JSON.stringify(tableItem),
data: {
csrfmiddlewaretoken: 'd42fc711-0414-4b03-be72-cfeb47226ba9'},

                    dataType: "json",
                    
                    
                    success: function(data, status) {
                        console.log(data);
                    },
                    error: function(data, status) {
                        alert("提交错误");
                    }
                });

nginx的配置:

location /cambridge {
if ($request_method = 'OPTIONS') {
add_header 'Access-Control-Allow-Origin' '';
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
add_header 'Access-Control-Max-Age' 1728000;
add_header 'Content-Type' 'text/plain charset=UTF-8';
add_header 'Content-Length' 0;
return 204;
}
if ($request_method = 'POST') {
add_header 'Access-Control-Allow-Origin' '';
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
}
if ($request_method = 'GET') {
add_header 'Access-Control-Allow-Origin' '*';
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
}

proxy_pass https://xxx.xxxx.com;
  }

希望能指点一下

Answer 1

if ($request_method = 'POST') {
add_header 'Access-Control-Allow-Origin' '*或者是你允许的域名';
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
}
你的post方法没有设置允许的域