CORS security with mobile apps : <p>We need to keep our API server security with CORS restriction : </p>

<pre><code>Access-Control-Allow-Origin : http://myonlinesite.com
</code></pre>

<p>But we also needs this API to be accessible for our mobile apps (Android+iOs).</p>

<p>All the solutions I found tell me to allow all origin : <code>*</code> , but this would be a big security failure for our API.</p>

<p>We are building our apps with Cordova, which WebView serves local files and therefore sends : <code>origin: null</code> , for all its http(s) requests. So we are thinking about adding <code>null</code> to the allowed origin. It's better, since it will block every other website attempting to fetch our API, but it will allow any mobile apps to fetch it...</p>

<p>Is there any more interesting solution for this ?</p>

<p>Thank you!</p>
