diff --git a/src/Cors/Origin.php b/src/Cors/Origin.php
index edba0bf..67fe744 100644
--- a/src/Cors/Origin.php
+++ b/src/Cors/Origin.php
@@ -19,7 +19,7 @@ final class Origin
         $parts = parse_url($origin);
         if (false === $parts
             || !isset($parts['scheme'], $parts['host'])
-            || isset($parts['user'], $parts['pass'], $parts['query'], $parts['fragment'])
+            || isset($parts['user']) || isset($parts['pass']) || isset($parts['query']) || isset($parts['fragment'])
             || (isset($parts['path']) && '/' !== $parts['path'])
         ) {
             throw new InvalidArgumentException(sprintf('Invalid CORS origin: %s', $origin));
diff --git a/src/EventHandler/NginxConfiguration.php b/src/EventHandler/NginxConfiguration.php
index a410b72..8400e04 100644
--- a/src/EventHandler/NginxConfiguration.php
+++ b/src/EventHandler/NginxConfiguration.php
@@ -56,8 +56,9 @@ final readonly class NginxConfiguration
             # The allowlist is emitted as exact Origin matches. Nginx omits an
             # add_header with an empty value, so missing/disallowed Origins do not
             # receive Access-Control-Allow-Origin. This applies after X-Accel.
-{$corsOriginRules}            add_header Access-Control-Allow-Origin $ondemand_hls_cors_origin always;
-            add_header Vary $ondemand_hls_cors_vary always;
+        {$corsOriginRules}
+            add_header Access-Control-Allow-Origin \$ondemand_hls_cors_origin always;
+            add_header Vary \$ondemand_hls_cors_vary always;
             add_header Cache-Control "private, no-store, max-age=0" always;
             add_header X-Content-Type-Options "nosniff" always;
             alias {$assetDirectory};
diff --git a/tests/Cors/OriginTest.php b/tests/Cors/OriginTest.php
index 58a0efd..66c5cc9 100644
--- a/tests/Cors/OriginTest.php
+++ b/tests/Cors/OriginTest.php
@@ -22,11 +22,13 @@ final class OriginTest extends TestCase
     public function testItRejectsPathsAndUnsafeOriginForms(): void
     {
         foreach (['*', 'null', 'https://aifrequency.org/path', 'https://user@example.org', 'file:///tmp/a'] as $origin) {
+            $rejected = false;
             try {
                 Origin::normalize($origin);
-                self::fail(sprintf('%s should be rejected.', $origin));
             } catch (InvalidArgumentException) {
+                $rejected = true;
             }
+            self::assertTrue($rejected, sprintf('%s should be rejected.', $origin));
         }
     }
 }