nginx.conf

server {
    listen       80;
    server_name  www.api.bandaid.com api.bandaid.com;
    root         /home/zach/dev/slim-bandaid;

    try_files $uri $uri/ /index.php?$args;
  
    location /index.php {
        fastcgi_connect_timeout 3s;     # default of 60s is just too long
        fastcgi_read_timeout 10s;       # default of 60s is just too long
        include fastcgi_params;
        fastcgi_pass 127.0.0.1:9000;    # assumes you are running php-fpm locally on port 9000
	
            if ($http_origin ~* (http?://[^/]*\.localhost(:[0-9]+)?)) {
                set $cors "true";
            }
	    set $cors "true";

	    if ($request_method = 'OPTIONS') {
                set $cors "${cors}options";
            }

            # non-OPTIONS indicates a normal CORS request
            if ($request_method = 'GET') {
                set $cors "${cors}get";
            }
            if ($request_method = 'POST') {
                set $cors "${cors}post";
            }

            # if it's a GET or POST, set the standard CORS responses header
            if ($cors = "trueget") {

                add_header 'Access-Control-Allow-Origin' "$http_origin";
                add_header 'Access-Control-Allow-Credentials' 'true';
                add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
		add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

            }

            if ($cors = "truepost") {
                add_header 'Access-Control-Allow-Origin' "$http_origin";
                add_header 'Access-Control-Allow-Credentials' 'true';
                add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
		add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
            }

            # if it's OPTIONS, then it's a CORS preflight request so respond immediately with no response body
            if ($cors = "trueoptions") {
                add_header 'Access-Control-Allow-Origin' "$http_origin";
                add_header 'Access-Control-Allow-Credentials' 'true';
                add_header 'Access-Control-Max-Age' 1728000;
                add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
                add_header 'Access-Control-Allow-Headers' 'Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since';
                add_header 'Content-Length' 0;
                add_header 'Content-Type' 'text/plain charset=UTF-8';
                return 204;
            }

    }
    
    
    error_log /var/log/nginx/api.bandaid_error.log;
    access_log /var/log/nginx/api.bandaid_access.log;
}