i fixed it. i removed the upstream server's headers.

        proxy_hide_header Access-Control-Allow-Origin;