code: public String extractCorsOrigin(String pOrigin) {
          if (pOrigin != null) {
              // Prevent HTTP response splitting attacks
              String origin  = pOrigin.replaceAll("[\\n\\r]*","");
              if (backendManager.isOriginAllowed(origin,false)) {
                  return "null".equals(origin) ? "*" : origin;
              } else {
                  return null;
              }
          }
          return null;
      }
docs: Check whether for the given host is a cross-browser request allowed. This check is delegated to the
  backendmanager which is responsible for the security configuration.
  Also, some sanity checks are applied.
  
  @param pOrigin the origin URL to check against
  @return the origin to put in the response header or null if none is to be set