Why my GETs worked but every POST got a 403: a CORS bug behind nginx in Docker
I'm a CS student building a tutoring management system: a Spring Boot REST API, a React frontend and PostgreSQL. While preparing the v1.2 release, I added a Docker Compose setup so anyone could run the whole stack with one command. It almost worked. The pages loaded, the lists showed up... and every time I clicked a button that changed something, the API answered: 403 Forbidden Invalid CORS…
In this story, a computer science student is developing a tutoring management system using Spring Boot REST API, React frontend, and PostgreSQL. The student added a Docker Compose setup for easy deployment. However, they encountered a CORS (Cross-Origin Resource Sharing) bug behind nginx in Docker that caused every POST and PATCH request to return a 403 Forbidden error, while GET requests worked fine.
The issue stemmed from the way nginx forwarded the Host header to the Spring Boot API. By default, nginx sets $host without the port number, which resulted in the Spring Boot API treating same-origin GET requests as cross-origin due to a mismatch in the Host and Origin headers. The allowedOrigins configuration in Spring Boot only included the Vite dev server's origin, causing the 403 errors for POST and PATCH requests.
The solution was to use $http_host instead of $host in the nginx configuration. $http_host preserves the port number, allowing Spring Boot to recognize the request as same-origin and skip the CORS checks. This fix corrected the issue without the need to add the frontend's origin to the allowedOrigins list, which would have been a temporary workaround rather than a proper solution.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
