title: how to block post request from different origin in node
body: <p>I'm going through this tutorial for building a node api:</p>
  
  <p><a href="http://scotch.io/tutorials/javascript/build-a-restful-api-using-node-and-express-4" rel="nofollow noreferrer">http://scotch.io/tutorials/javascript/build-a-restful-api-using-node-and-express-4</a></p>
  
  <p>They go through how to test post requests with getpostman.com.</p>
  
  <p>However - I don't want my application to respond to post requests from different domains. I only want it to respond to post requests from Rails on my domain (not browser). How do I stop accepting these requests from foreign origins, yet allow the requests from my rails server?</p>
  
  <p>I tried middleware like the below which I found from <a href="https://stackoverflow.com/questions/11181546/node-js-express-cross-domain-scripting">this</a> link. But didn't work. This has to be easy. Any clues?</p>
  
  <pre><code>router.all('/', function(req, res, next) {
    res.header("Access-Control-Allow-Origin", "https://www.example.com");
    res.header("Access-Control-Allow-Headers", "X-Requested-With");
    res.header("Access-Control-Allow-Methods", "POST GET");
    res.header("X-Frame-Options", "ALLOWALL");
    res.header("Access-Control-Allow-Credentials", "true");
    next();
   });
  </code></pre>