Access-Control-Allow-Origin on F5

Had to do a little research on CORS:

http://en.wikipedia.org/wiki/Cross-origin_resource_sharing

And based on the above, this is perhaps a start:

when HTTP_REQUEST {
    if { [HTTP::header exists Origin] } {
        set origin_host [HTTP::header Origin]
    }
}
when HTTP_RESPONSE {
    if { [info exists origin_host] } {
        if { $origin_host equals "http://www.example.com" } {
            HTTP::header insert Access-Control-Allow-Origin $origin_host
        }
    }
}

Another way to approach is this (we actually have this running in prod - we have some clients for which CORS support in the server is mandatory, so we fake it);

when HTTP_REQUEST {

   if {[HTTP::method] eq "OPTIONS"} {

       HTTP::respond 200 Access-Control-Allow-Origin "[HTTP::header Origin]" \
                    Access-Control-Allow-Methods "POST, GET" \
                    Access-Control-Allow-Headers "soapaction" \
                    Access-Control-Allow-Credentials "true"
       return
  } 
}