crossdomain.js

module.exports.allowCrossDomain = function(req, res, next) {
    var oneof = false
        , clientUrl = 'http://myclient.com';
        
    if (req.headers.origin) {
        res.header('Access-Control-Allow-Origin', clientUrl);
        res.header('Access-Control-Allow-Credentials', true);
        oneof = true;
    }
    if (req.headers['access-control-request-method']) {
        res.header('Access-Control-Allow-Methods', 'GET, POST');
        oneof = true;
    }
    if (req.headers['access-control-request-headers']) {
        res.header('Access-Control-Allow-Headers', req.headers['access-control-request-headers']);
        oneof = true;
    }
    if (oneof) {
        res.header('Access-Control-Max-Age', 60 * 60 * 24 * 365);
    }

    if (oneof && req.method == 'OPTIONS') res.send(200);
    else                                  next();
};

server.js

// ...

app.use(require('./config/crossdomain').allowCrossDomain);

// ... Set up routing, etc.