Getting value from session if available, if not, take from the database
Some recommendations:

1) Give your method a better name. ResponseAsJson is not what it does. Proposal: AppendAllowOriginHeader

2) Your method relies on the affiliateId inputparameter. I would change the parameter to int? affiliateId and then add a short guard:

if(!affiliateId.HasValue) {
   throw new ArgumentNullException(nameof(affiliateId)); 
}


Also keep in mind, that the id may be invalid in which I would prefere to throw an InvalidArgumentException

3) Let's clean up: Extract the method in two subfunctions:TryAddFromCache(string key) and TryAddFromAllowedOrigins

TryAddFromCache could look like:

if(String.IsNullOrWhiteSpace(key)) {
   return false;
}   

...
return true;


And in AppendAllowOriginHeader:

if (TryAddFromCache()) {
    return;
}


4) As a rule: Use const or var wherever possible.

5) Extract a second method: 

bool TryAddFromAllowedOrigins(IEnumerable&lt;string&gt; allowedOrigins) { ... }

6) Performance: In this case we have the database access as bottleneck.
The party starts at:

RM.BL.Affiliate.Instance(affiliateId).LUAffiliate.AccessControlAllowOriginJsonResult.Split(';');


.. which has the most impact.

Your array strFromDB will probably not hold references to several thousand strings. So filtering or sorting (which should be the work of the db anyway) has no impact.

 string strLocalhost = strFromDB.Where(x =&gt; x.ToLower().StartsWith("http://localhost")).FirstOrDefault();


can be changed to:

strFromDB.FirstOrDefault(x =&gt; x.ToLower().StartsWith("..."));


7) Consider using better names: for example strFromDB could be changed to allowedOrigins