Access-Control-Allow-Origin Limit

Question

I have set up our public facing website with the header Access-Control-Allow-Origin: * so that we can use JSON and AJAX. However, what I really want to do is limit it to only certain servers. The requests should only ever come from a few servers that we control. I am having trouble finding something works without adding in code (example psuedo-code):

for each domain in myDomains
    addheader Access-Control-Allow-Origin: domain
next

Is it possible to just add multiple "Access-Control-Allow-Origin" in IIS under the HTTP Headers tab? I know that it is possible to actually add it to IIS, but does it work?

Example:

Access-Control-Allow-Origin: http://domain1
Access-Control-Allow-Origin: http://domain2
Access-Control-Allow-Origin: http://127.0.0.1 (use using home as IP example)

Using Access-Control-Allow-Origin: * is just to insecure.

Answer 1

No, multiple Access-Control-Allow-Origin headers are not allowed. You can only have one Access-Control-Allow-Origin response header, and that header can only have one origin value or * (e.g. you can't have multiple space-separated origins).

Your best option is to read the incoming Origin header, check its value against a whitelist, and only emit the Access-Control-Allow-Origin header if the Origin is allowed. Here's an example in pseudo-code:

origin = request.getHeader('Origin');
for each domain in myDomains
  if (domain == origin)
    // Add header if the origin is whitelisted
    addheader Access-Control-Allow-Origin: domain
    return
// Otherwise exit the for loop without adding any headers.