+ allowing * domains for acceptable connections by cors politic - allowing downloading files from uploads dir from scripting download

config/nginx/includes.d/octobercms.conf

@@ -1,47 +1,56 @@
-
-    location / {
+location / {
     rewrite ^/.*$ /index.php last;
-    }
-    location ~ ^/combine.*\.(css|js) {
+}
+location ~ ^/combine.*\.(css|js) {
     rewrite ^/.*$ /index.php last;
     expires max;
-    }
-
-    # Whitelist
-    ## Let October handle if static file not exists
-    location = /favicon.ico { try_files $uri /index.php; }
-    location ~ ^/.*\.xml { try_files $uri /index.php; }
-    location = /robots.txt { try_files $uri /index.php; }
-    location = /humans.txt { try_files $uri /index.php; }
-
-    ## Let nginx return 404 if static file not exists
-    location /storage/app/uploads/public { try_files $uri /404; }
-    location /storage/app/media { try_files $uri /404; }
-    location /storage/app/yml { try_files $uri /404; }
-    location /storage/app/docx { try_files $uri /404; }
-    location /storage/app/resized { try_files $uri /404; }
-    location /storage/temp/public { try_files $uri /404; }
-
-    location ~ ^/modules/.*/assets { try_files $uri /404; }
-    location ~ ^/modules/.*/resources { try_files $uri /404; }
-    location ~ ^/modules/.*/behaviors/.*/assets { try_files $uri /404; }
-    location ~ ^/modules/.*/behaviors/.*/resources { try_files $uri /404; }
-    location ~ ^/modules/.*/widgets/.*/assets { try_files $uri /404; }
-    location ~ ^/modules/.*/widgets/.*/resources { try_files $uri /404; }
-    location ~ ^/modules/.*/formwidgets/.*/assets { try_files $uri /404; }
-    location ~ ^/modules/.*/formwidgets/.*/resources { try_files $uri /404; }
-    location ~ ^/modules/.*/reportwidgets/.*/assets { try_files $uri /404; }
-    location ~ ^/modules/.*/reportwidgets/.*/resources { try_files $uri /404; }
-
-    location ~ ^/plugins/.*/.*/assets { try_files $uri /404; }
-    location ~ ^/plugins/.*/.*/resources { try_files $uri /404; }
-    location ~ ^/plugins/.*/.*/behaviors/.*/assets { try_files $uri /404; }
-    location ~ ^/plugins/.*/.*/behaviors/.*/resources { try_files $uri /404; }
-    location ~ ^/plugins/.*/.*/reportwidgets/.*/assets { try_files $uri /404; }
-    location ~ ^/plugins/.*/.*/reportwidgets/.*/resources { try_files $uri /404; }
-    location ~ ^/plugins/.*/.*/formwidgets/.*/assets { try_files $uri /404; }
-    location ~ ^/plugins/.*/.*/formwidgets/.*/resources { try_files $uri /404; }
-    location ~ ^/plugins/.*/.*/widgets/.*/assets { try_files $uri /404; }
-    location ~ ^/plugins/.*/.*/widgets/.*/resources { try_files $uri /404; }
-
-    location ~ ^/themes/.*/resources { try_files $uri /404; }
+}
+
+# Whitelist
+
+## Let October handle if static file not exists
+
+location = /favicon.ico { try_files $uri /index.php; }
+location ~ ^/.*\.xml { try_files $uri /index.php; }
+location = /robots.txt { try_files $uri /index.php; }
+location = /humans.txt { try_files $uri /index.php; }
+
+## Let nginx return 404 if static file not exists
+
+location /storage/app/uploads/public {
+    # add proxy cors headers
+    add_header Access-Control-Allow-Headers "*" always;
+    add_header Access-Control-Allow-Methods "*" always;
+    add_header Access-Control-Allow-Origin  "*" always;
+    try_files $uri /404;
+}
+
+location /storage/app/media { try_files $uri /404; }
+location /storage/app/yml { try_files $uri /404; }
+location /storage/app/docx { try_files $uri /404; }
+location /storage/app/resized { try_files $uri /404; }
+location /storage/temp/public { try_files $uri /404; }
+
+location ~ ^/modules/.*/assets { try_files $uri /404; }
+location ~ ^/modules/.*/resources { try_files $uri /404; }
+location ~ ^/modules/.*/behaviors/.*/assets { try_files $uri /404; }
+location ~ ^/modules/.*/behaviors/.*/resources { try_files $uri /404; }
+location ~ ^/modules/.*/widgets/.*/assets { try_files $uri /404; }
+location ~ ^/modules/.*/widgets/.*/resources { try_files $uri /404; }
+location ~ ^/modules/.*/formwidgets/.*/assets { try_files $uri /404; }
+location ~ ^/modules/.*/formwidgets/.*/resources { try_files $uri /404; }
+location ~ ^/modules/.*/reportwidgets/.*/assets { try_files $uri /404; }
+location ~ ^/modules/.*/reportwidgets/.*/resources { try_files $uri /404; }
+
+location ~ ^/plugins/.*/.*/assets { try_files $uri /404; }
+location ~ ^/plugins/.*/.*/resources { try_files $uri /404; }
+location ~ ^/plugins/.*/.*/behaviors/.*/assets { try_files $uri /404; }
+location ~ ^/plugins/.*/.*/behaviors/.*/resources { try_files $uri /404; }
+location ~ ^/plugins/.*/.*/reportwidgets/.*/assets { try_files $uri /404; }
+location ~ ^/plugins/.*/.*/reportwidgets/.*/resources { try_files $uri /404; }
+location ~ ^/plugins/.*/.*/formwidgets/.*/assets { try_files $uri /404; }
+location ~ ^/plugins/.*/.*/formwidgets/.*/resources { try_files $uri /404; }
+location ~ ^/plugins/.*/.*/widgets/.*/assets { try_files $uri /404; }
+location ~ ^/plugins/.*/.*/widgets/.*/resources { try_files $uri /404; }
+
+location ~ ^/themes/.*/resources { try_files $uri /404; }