title: How to set allowed origin to request host in Rails 5
body: <p>I am writing an application with a couple of APIs that should be accessible from any host. Now, so far I have handled this in my <code>application.rb</code> in the following way:</p>
  
  <pre><code>config.action_dispatch.default_headers = {
    'Access-Control-Allow-Origin' =&gt; '*'
  }
  </code></pre>
  
  <p>However, one of the clients that accesses the API doesn't allow to get data from sources where <code>'*'</code> is defined. My idea was to set the allowed origin dynamically to the one that requests the API. Something like this:</p>
  
  <pre><code>Rails.application.config.middleware.insert_before 0, Rack::Cors do
    allow do
      origins ActionDispatch::Request.headers['Host']
  
      resource '*',
        headers: :any,
        methods: [:get, :post, :put, :patch, :delete, :options, :head]
    end
  end
  </code></pre>
  
  <p>But since <code>cors.rb</code> is an initializer, it doesn't have access to the requests that come in. Is there a way to make the origins list dynamic, so it will always just include the request host?</p>