title: Express CORS domain whitelist
body: <p>I am using this module to handle cors requests <a href="https://www.npmjs.com/package/cors" rel="nofollow">https://www.npmjs.com/package/cors</a>
  I need to restrict all domains except whitelisted</p>
  
  <p>From official CORS module example:</p>
  
  <pre><code>var whitelist = ['http://example1.com', 'http://example2.com'];
  var corsOptions = {
    origin: function(origin, callback){
      var originIsWhitelisted = whitelist.indexOf(origin) !== -1;
      callback(null, originIsWhitelisted);
    }
  };
  
  app.get('/products/:id', cors(corsOptions), function(req, res, next){
    res.json({msg: 'This is CORS-enabled for a whitelisted domain.'});
  });
  </code></pre>
  
  <p>Which I have changed to this to make it work:</p>
  
  <pre><code>var origin;
  var corsOptions;
  app.all('*', function (req, res, next) {
      origin = req.get('origin');
      var whitelist = ['http://example1.com', 'http://example2.com'];
      corsOptions = {
          origin: function (origin, callback) {
              var originIsWhitelisted = whitelist.indexOf(origin) !== -1;
              callback(null, originIsWhitelisted);
          }
      };
      next();
  });
  app.post('/products/:id', cors(corsOptions), function (req, res, next) {
      res.json({ msg: 'This is CORS-enabled for a whitelisted domain.' });
  });
  </code></pre>
  
  <p>Then I run test from <code>http://localhost:8080</code> by posting to <code>app.post('/products/:id'...)</code> I expected it should not be executed because <code>http://localhost:8080</code> is not whitelisted but actually it did. Any idea why and how to fix that?</p>
  
  <p>Also I  didadd <code>cors(corsOptions)</code> to watch but it is saying - <code>not available</code></p>