code: def check_origin(self, origin: str) -> bool:
          
          parsed_origin = urlparse(origin)
          origin = parsed_origin.netloc
          origin = origin.lower()
  
          host = self.request.headers.get("Host")
  
          # Check to see that origin matches host directly, including ports
          return origin == host
docs: Override to enable support for allowing alternate origins.
  
          The ``origin`` argument is the value of the ``Origin`` HTTP
          header, the url responsible for initiating this request.  This
          method is not called for clients that do not send this header;
          such requests are always allowed (because all browsers that
          implement WebSockets support this header, and non-browser
          clients do not have the same cross-site security concerns).
  
          Should return ``True`` to accept the request or ``False`` to
          reject it. By default, rejects all requests with an origin on
          a host other than this one.
  
          This is a security protection against cross site scripting attacks on
          browsers, since WebSockets are allowed to bypass the usual same-origin
          policies and don't use CORS headers.
  
          .. warning::
  
             This is an important security measure; don't disable it
             without understanding the security implications. In
             particular, if your authentication is cookie-based, you
             must either restrict the origins allowed by
             ``check_origin()`` or implement your own XSRF-like
             protection for websocket connections. See `these
             <https://www.christian-schneider.net/CrossSiteWebSocketHijacking.html>`_
             `articles
             <https://devcenter.heroku.com/articles/websocket-security>`_
             for more.
  
          To accept all cross-origin traffic (which was the default prior to
          Tornado 4.0), simply override this method to always return ``True``::
  
              def check_origin(self, origin):
                  return True
  
          To allow connections from any subdomain of your site, you might
          do something like::
  
              def check_origin(self, origin):
                  parsed_origin = urllib.parse.urlparse(origin)
                  return parsed_origin.netloc.endswith(".mydomain.com")
  
          .. versionadded:: 4.0