You need to use the more_set_headers module.
with -s you can specify the status code
more_set_headers -s '404,400,403' 'Access-Control-Allow-Origin: http://domain.com';
However, if you did not install this module in nginx, you need to recompile it. compile it:
wget http://nginx.org/download/nginx-1.7.8.tar.gz git clone https://github.com/openresty/headers-more-nginx-module.git tar -xzvf nginx-1.7.8.tar.gz cd nginx-1.7.8 ./configure --prefix=/opt/nginx --add-module=/path/to/headers-more-nginx-module make make install
source share