Although it is possible to set the Access-Control-Allow-Origin header value globally in web.config for Windows IIS Server, the Microsoft ASP.NET Web API Cross-Origin Support package provides classes and interfaces for the sophisticated handling of CORS requests.
Tip
In general, best practices for CORS recommend setting the CORS-enabling Access-Control-Allow-Origin header only on pages where it is actually needed, rather than setting it globally on every page. Also consider the security implications of allowing CORS requests globally, particularly when using the wildcard "*".
You may also allow a single domain instead of allowing all domains with the wildcard. Until the CORS specification supporting multiple allowed domains is widely supported in client browsers, you will need to use additional logic in code to allow a specific set of allowed domains.