Simple CORS for WordPress with domain control.

wordpress_cors.php

//Add it in your Functions file at the least
//Created a function to hook into the init. 
//

function add_cors_http_header(){
    
    //An Array of allowed domains.
    $allowed = array(
      "http://localhost:3000",
      "http://another-domain.com"
    );

    $origin = get_http_origin();
    if ( $origin && in_array($origin, $allowed) ) {
        header( 'Access-Control-Allow-Origin: ' . esc_url_raw( $origin ) );
        header( 'Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE' );
        header( 'Access-Control-Allow-Credentials: true' );
    }

}
add_action('init','add_cors_http_header');