I have a server setup with nginx serving static content and proxy all PHP/dynamic requests to apache on 127.0.0.1
I'm building an API for my databases, and I need to allow clients by their origin (domain name), rather than just IP. Based on CORS rules.
So when I send an HTTP header
header("Access-Control-Allow-Origin: www.client-requesting.myapi.com"); from my API server, I have to tell it which origin I allow, otherwise client side requests won't work to my API due to same-origin policy.
The question is how can I know which domain name (if any) called my API?
What should be the nginx and apache configuration to pass the origin parameter? I tried to google, and all I found is some possible solution with mod_rpaf, but I wanted to be sure.