title: Flask Access-Control-Allow-Origin for multiple URLs
body: <p>I have an API written in python/flask and I want to allow only a couple URLs to access this API. The JavaScript call is trivial jQuery, like: </p>
  
  <pre><code>    $.ajax({
       url: "http://myApi.com/api/doit",  
       dataType:'JSON',
       success:function(data){
         console.log("DEBUG: yeeeeaaaahhh!");
       },
       error:function(xhr){
         console.log("Error occured! status: " + xhr.status + ", text: " + xhr.statusText);
       }
    });
  </code></pre>
  
  <p>Most of the solutions mainly here are pretty disappointing always offering to set <code>Access-Control-Allow-Origin : '*'</code> or to start chrome disabling the check. Of course it works, but this is not the purpose. 
  The spec on <a href="https://www.w3.org/TR/cors/" rel="noreferrer">w3</a> says a semicolon separated list should work, but it doesn't. Also comma separated list failed. 
  From flask itself there is <a href="http://flask.pocoo.org/snippets/56/" rel="noreferrer">http://flask.pocoo.org/snippets/56/</a> but it does not work with multiple URLs. In the comments there is a suggestion: <code>h.extend([("Access-Control-Allow-Origin", orig) for orig in origin])</code> but it still does not work.</p>
  
  <p>The only solution I have is to check in code the origin and in case it is in my white list to put in the header <code>Access-Control-Allow-Origin : '*'</code>. This is a workaround but I don't like it that much. Can you suggest a more elegant solution?</p>