code: private String checkOriginHeader(HttpServletRequest request, JCorsConfig config) {
  
  		String originHeader = request.getHeader(CorsHeaders.ORIGIN_HEADER);
  		Constraint.ensureNotEmpty(originHeader, "Cross-Origin requests must specify an Origin Header");
  
  		String[] origins = originHeader.split(" ");
  
  		for (String origin : origins) {
  			Constraint.ensureTrue(config.isOriginAllowed(origin), String.format("The specified origin is not allowed: '%s'", origin));
  		}
  
  		return originHeader;
  	}
docs: Checks if the origin is allowed
  
  @param request
  @param config