Edit Access-Control-Allow-Origin based on client's request

src/main/java/cz/hsrs/servlet/security/ControllerServlet.java

@@ -7,6 +7,7 @@ import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
+import javax.ws.rs.core.Request;
 
 import cz.hsrs.servlet.provider.DBServlet;
 
@@ -69,8 +70,10 @@ public class ControllerServlet extends DBServlet {
             }
             /** request doesn't contain coming parameter - came from REST client*/
             else{
+                String originDomain = req.getHeader("origin");
+                originDomain = originDomain == null ? req.getScheme() + ":\\\\" + req.getServerName() : "*";
                 resp.setStatus(200);
-                resp.setHeader("Access-Control-Allow-Origin", "*");
+                resp.setHeader("Access-Control-Allow-Origin", originDomain);
                 resp.setHeader("Content-Type", "application/json; charset=utf-8");
                 resp.getWriter().println("{\"sessionid\":\""+req.getSession().getId()+"\", \"language\":\""+user.getUserLanguage()+"\", \"audio\":\"" + user.isAudio() + "\", \"rightsID\":"+user.getRightsId()+"}");
             }