# Create white list in doOptions to allow access to specific sites

**URL:** <https://forum.inductiveautomation.com/t/create-white-list-in-dooptions-to-allow-access-to-specific-sites/89142>\
**Category:** Ignition\
**Tags:** ignition81\
**Created:** [April 19, 2024, 8:41pm UTC](https://forum.inductiveautomation.com/t/create-white-list-in-dooptions-to-allow-access-to-specific-sites/89142 "2024-04-19T20:41:42Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![fmata](https://avatars.discourse-cdn.com/v4/letter/f/8e7dd6/32.png) [@fmata](https://forum.inductiveautomation.com/u/fmata)\
**Post date:** [April 19, 2024, 8:41pm UTC](https://forum.inductiveautomation.com/t/create-white-list-in-dooptions-to-allow-access-to-specific-sites/89142/1 "2024-04-19T20:41:42Z")

</div>

Hi there,

I hope this message finds you well. I'm currently exploring how to create a whitelist in the Webdev Module. However, I've encountered an obstacle in obtaining the origin URL.

I attempted the following approach:

```python
request.setHeader("Access-Control-Allow-Origin", "https://www.origen1.com, https://www.origen2.com")

```

Unfortunately, it seems that CORS treats the string as a single entity, rather than evaluating each URL separately. As a result, this method isn't functioning as intended.

I'm aiming to achieve something similar to the code snippet below, but I'm unsure where to obtain the origin URL:

```python
	servletResp = request['servletResponse']
	origin_header = request.getHeader("Origin")
	request.setHeader("Access-Control-Allow-Origin", "https://www.origen1.com, https://www.origen2.com")
	if origin_header in whiteList:
		servletResp.setHeader("Access-Control-Allow-Origin", origin_header)
	else:
		servletResp.setHeader("Access-Control-Allow-Origin", "null")

```

PS: I am not willing to considere possibility to use "\*".