nginx api conf

api.dev

server {
	server_name api.foo.dev;

	listen 80;

	access_log /var/log/nginx/api.foo.dev.access.log;
	error_log /var/log/nginx/api.foo.dev.error.log;

	root /home/user/Projects/foo/server/api/public;

	index index.php;

	set $cors_headers 'custom-header,another-custom-header';

	
	location / {
		try_files $uri $uri/ /index.php$uri?$args;
	}
	
	location /index.php {
		#enable cors
		include /etc/nginx/cors-nginx.conf;

		fastcgi_split_path_info ^(index\.php)(/.+)$;			
		fastcgi_pass unix:/var/run/php5-fpm.sock;
		fastcgi_index index.php;
		include fastcgi_params;
		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	}

	# We don't need .ht files with nginx.
	location ~ /\.ht {
		deny all;
	}
}

With my configuration, you can restrict which origins you want to allow. You may want to look into modifying this to allow that.

I can control allowed origins from laravel