Allow requests only from my chrome extension
<p>I have a NodeJS server set up and working with Express, hosted on DigitalOcean. I'm making GET calls to it from within my Chrome extension. It currently works great, but I'd like to tighten down the security on the following middleware:</p>

<pre><code>// Add headers
app.use(function (req, res, next) {

// Website you wish to allow to connect
res.setHeader('Access-Control-Allow-Origin', '*'); //todo: change this

// Request methods you wish to allow
res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS, PUT, PATCH, DELETE');

// Request headers you wish to allow
res.setHeader('Access-Control-Allow-Headers', 'X-Requested-With,content-type');

// Set to true if you need the website to include cookies in the requests sent
// to the API (e.g. in case you use sessions)
res.setHeader('Access-Control-Allow-Credentials', true);

// Pass to next layer of middleware
next();
});
</code></pre>

<p>The problem is, I think the <code>*</code> in <code>access-control-allow-origin</code> is letting anyone hit my endpoint. Is there a way to only allow calls from my Chrome extension, and not anywhere else?</p>

<p>Thanks in advance,
Sam</p>