code: private void setCorsHeader(HttpServletRequest pReq, HttpServletResponse pResp) {
          String origin = requestHandler.extractCorsOrigin(pReq.getHeader("Origin"));
          if (origin != null) {
              pResp.setHeader("Access-Control-Allow-Origin", origin);
              pResp.setHeader("Access-Control-Allow-Credentials","true");
          }
      }
docs: Set an appropriate CORS header if requested and if allowed