{
  "id": 15778910,
  "title": "Why my GETs worked but every POST got a 403: a CORS bug behind nginx in Docker",
  "url": "https://urgent.news/2026/10/20/why-my-gets-worked-but-every-post-got-a-403-a-cors-bug-behind-nginx",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-20T18:03:49.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/joao_abreu/why-my-gets-worked-but-every-post-got-a-403-a-cors-bug-behind-nginx-in-docker-2io"
  },
  "original_language": "en",
  "account": "In this story, a computer science student is developing a tutoring management system using Spring Boot REST API, React frontend, and PostgreSQL. The student added a Docker Compose setup for easy deployment. However, they encountered a CORS (Cross-Origin Resource Sharing) bug behind nginx in Docker that caused every POST and PATCH request to return a 403 Forbidden error, while GET requests worked fine.\n\nThe issue stemmed from the way nginx forwarded the Host header to the Spring Boot API. By default, nginx sets $host without the port number, which resulted in the Spring Boot API treating same-origin GET requests as cross-origin due to a mismatch in the Host and Origin headers. The allowedOrigins configuration in Spring Boot only included the Vite dev server's origin, causing the 403 errors for POST and PATCH requests.\n\nThe solution was to use $http_host instead of $host in the nginx configuration. $http_host preserves the port number, allowing Spring Boot to recognize the request as same-origin and skip the CORS checks. This fix corrected the issue without the need to add the frontend's origin to the allowedOrigins list, which would have been a temporary workaround rather than a proper solution.",
  "summary": "I'm a CS student building a tutoring management system: a Spring Boot REST API, a React frontend and PostgreSQL. While preparing the v1.2 release, I added a Docker Compose setup so anyone could run the whole stack with one command. It almost worked. The pages loaded, the lists showed up... and every time I clicked a button that changed something, the API answered: 403 Forbidden Invalid CORS…",
  "key_points": [
    "Student developed tutoring management system with Spring Boot, React, PostgreSQL.",
    "CORS bug behind nginx in Docker caused 403 errors on POST/PATCH, not GET.",
    "Fix used $httphost in nginx config to preserve port number and same-origin recognition."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}