title: Allowing AJAX requests to service behind nginx proxy based on request_method
body: <p>I'm new to Nginx, so pardon me if I'm being obtuse.  I have a service that is sitting behind an nginx proxy, and I am using auth_basic to prevent anyone from currently being able to hit it.  I want to allow an Angular app to hit this service, but I want to control who is allowed to perform particular request methods (GET, POST, DEL, OPTIONS), and using auth_basic doesn't seem like the best bet, since I don't want to hardcode the login/password into the JS (duh).  The only way I can figure out how to do this is to say:  </p>
  
  <pre><code>if ($request_method = OPTIONS)
  { 
          proxy_pass_header Access-Control-Allow-Origin *;
          proxy_pass_header Access-Control-Allow_Methods GET, OPTIONS;
          etc...
  }
  </code></pre>
  
  <p>At this point, I'd allow GET and OPTIONS requests from anyone, but I want to restrict POST, DEL to only from certain locations (such as internally, or from a trusted IP).  Currently, though, if I put proxy_pass_header into that block, it says that the directive is not allowed.  I've seen other examples where people use add_header inside an if block like that, so I'm confused why that isn't working.</p>
  
  <p>So first of all, is this the best way of doing things, and if not, does someone have another recommendation?  If it is the best way of handling things, what am I doing wrong here? </p>
  
  <p>Any help would be appreciated.  I find the nginx documentation to be very confusing.</p>