Blog
NGINX Plus: dynamic CORS with key-value stores, maps, and synchronized state across cluster nodes
Use `keyval` zones to update Allow-Origin lists without reloads—ensure sync latency fits your incident response.
1 min read
nginxcorsload-balancer
Sticky sessions
CORS and session affinity interact—misaligned cookies can look like CORS failures in SPAs.
Health checks should not hit OPTIONS endpoints unless you mirror production CORS.
Rate limiting
Limit preflight separately from GET/POST to avoid blocking legitimate retries.
Burst zones can starve OPTIONS during attacks—monitor 429 ratios on credentialed flows.