Finally i had to comp up with removing cors from parse server itself. I edited /root/parse-server/node_modules/parse-server/lib/middlewares.js and commented out all the res.header(...) lines that set Access-Control-Allow-*. This disabled Parse's built-in CORS behavior, so Nginx could take over cleanly.