jdrupal-cors-example.settings.php

$allowed_cors_origins = array('http://localhost:9000/', 'http://isovera.github.io/');
if (in_array($_SERVER['HTTP_REFERER'], $allowed_cors_origins)) {
  header("Access-Control-Allow-Origin: " . substr($_SERVER['HTTP_REFERER'], 0, -1));
  header("Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE");
  header("Access-Control-Allow-Headers: content-type, X-CSRF-Token");
  header("Access-Control-Allow-Credentials: true");
}