code: def process_response(self, request, response, resource, req_succeeded):
          
          response.set_header('Access-Control-Allow-Credentials', str(self.allow_credentials).lower())
  
          origin = request.get_header('ORIGIN')
          if origin and (origin in self.allow_origins) or ('*' in self.allow_origins):
              response.set_header('Access-Control-Allow-Origin', origin)
  
          if request.method == 'OPTIONS': # check if we are handling a preflight request
              allowed_methods = set(
                  method
                  for _, routes in self.api.http.routes.items()
                  for method, _ in routes[self.match_route(request.path)].items()
              )
              allowed_methods.add('OPTIONS')
  
              # return allowed methods
              response.set_header('Access-Control-Allow-Methods', ', '.join(allowed_methods))
              response.set_header('Allow', ', '.join(allowed_methods))
  
              # get all requested headers and echo them back
              requested_headers = request.get_header('Access-Control-Request-Headers')
              response.set_header('Access-Control-Allow-Headers', requested_headers or '')
  
              # return valid caching time
              if self.max_age:
                  response.set_header('Access-Control-Max-Age', self.max_age)
docs: Add CORS headers to the response