JAVASCRIPT

To disable server-to-server and REST tools like Postman to access our API - Remove !origin from your if statement.

var whitelist = ['http://example.com']
var corsOptions = {
  origin: function (origin, callback) {
    if (whitelist.indexOf(origin) !== -1) {
      callback(null, true)
    } else {
      callback(new Error('Not allowed by CORS'))
    }
  }
}

app.use(cors(corsOptions));