How to include header "Access-Control-Allow-Origin" as part of PI response

Hi Guys

Need some help here.

My mobile app vendor is invoking my web service via SAP PI. However they require a response header - Access-Control-Allow-Origin in order to access the services due to CORS. They claim that their invocation is blocked due to javascript's security for cross-domain access via xmlhttprequest calls.

Does anyone has any idea on how to go about doing it ?

Current Process:

Mobile Apps --> SAP PI --> Web Service running on IIS (.NET)

Will appreciate any reply/help.

Thanks

Bertina