Drugstore.com is legit. I read somewhere they are the only or one of the few strictly online stores to be able to sell prescription drugs, while most have pharmacies as well. Their accredited by VIPPS as well which is Verified Internet Pharmacy Practice Site for U.S.
There are cheaper places to buy propecia but they are legit.