Allowing AJAX requests to service behind nginx proxy based on request_method -

i'm new nginx, pardon me if i'm being obtuse. have service sitting behind nginx proxy, , using auth_basic prevent being able hit it. want allow angular app hit service, want control allowed perform particular request methods (get, post, del, options), , using auth_basic doesn't seem best bet, since don't want hardcode login/password js (duh). way can figure out how say:

if ($request_method = options) {          proxy_pass_header access-control-allow-origin *;         proxy_pass_header access-control-allow_methods get, options;         etc... } 

at point, i'd allow , options requests anyone, want restrict post, del locations (such internally, or trusted ip). currently, though, if put proxy_pass_header block, says directive not allowed. i've seen other examples people use add_header inside if block that, i'm confused why isn't working.

so first of all, best way of doing things, , if not, have recommendation? if best way of handling things, doing wrong here?

any appreciated. find nginx documentation confusing.

you use deny/allow directives ngx_http_access_module.

location / {     deny  192.168.1.1;     allow 192.168.1.0/24;     allow 10.1.1.0/16;     allow 2001:0db8::/32;     deny  all; } 

http://nginx.org/en/docs/http/ngx_http_access_module.html