Here' the minimal Access-Control-Allow-Origin header insertion necessary to allow any whitelisted sites to access resources via CORS headers.

cors-nginx.conf

#
# Minimal CORS config for nginx
#
# A modification of https://gist.github.com/alexjs/4165271
#
# NB: This relies on the use of the 'Origin' HTTP Header.

location /static {

    if ($http_origin ~* (whitelist\.address\.one|whitelist\.address\.two)$) {
        add_header Access-Control-Allow-Origin "$http_origin";
    }

}