ApiHelper Class

ApiHelper.php

<?php

class ApiHelper
{
    public static function GetAllowedOrigins()
    {
        if ($key = Yii::app()->getRequest()->getParam('apikey')) {
            $origins = Origin::model()->findAll(array(
                'select' => 'url',
                'with' => array('key_search' =>
                    array(
                        'select' => false,
                        'together' => true,
                    )
                ),
                'condition' => 'key_search.key = :apiKey',
                'params' => array(
                    ':apiKey' => $key,
                )
            ));

            return array_map(function ($origin) {
                return $origin->url;
            }, $origins);
        }
        return array();
    }

}

m150430_064427_create_api_key_tables.php

<?php

class m150430_064427_create_api_key_tables extends CDbMigration
{
    public function safeUp()
    {
        $this->createTable('{{apikey}}', array(
            'id' => 'pk',
            'key' => 'varchar(64) not null',
            'KEY `key_index` (`key`)'
        ), 'ENGINE=InnoDB'
        );

        $this->createTable('{{origin}}', array(
            'id' => 'pk',
            'url' => 'varchar(256) not null',
            'key_id' => 'int(10) NOT NULL',
            'foreign key (`key_id`) references `{{apikey}}` (`id`) on delete cascade on update cascade',
        ), 'ENGINE=InnoDB'
        );
    }

    public function safeDown()
    {
        $this->dropTable('{{origin}}');
        $this->dropTable('{{apikey}}');
    }
}

restEvents

public function restEvents()
{

    $this->onRest('req.cors.access.control.allow.origin', function() {
        return ApiHelper::GetAllowedOrigins();
    });

    $this->onRest('req.cors.access.control.allow.methods', function() {
        return array('GET', 'POST', 'PUT', 'DELETE','OPTIONS');
    });

    $this->onRest('req.cors.access.control.allow.headers', function($application_id) {
        return array();
    });

    $this->onRest('req.auth.type', function($application_id) {
        // set value of origin header, if not present
        $origin = isset($_SERVER['HTTP_ORIGIN']) ? $_SERVER['HTTP_ORIGIN'] : Yii::app()->getBaseUrl(true);
        $_SERVER['HTTP_ORIGIN'] = $origin;

        // treat all request as CORS
        return ERestEventListenerRegistry::REQ_TYPE_CORS;
    });
}