private static Set<String> validateOrigins(Iterable<String> allowedOrigins) {
        //TODO(minwoox): Dedup the same logic in cors service.
        final Set<String> copied = ImmutableSet.copyOf(requireNonNull(allowedOrigins, "allowedOrigins"))
                                               .stream()
                                               .map(Ascii::toLowerCase)
                                               .collect(toImmutableSet());
        checkArgument(!copied.isEmpty(), "allowedOrigins is empty. (expected: non-empty)");
        if (copied.contains(ANY_ORIGIN)) {
            if (copied.size() > 1) {
                logger.warn("Any origin (*) has been already included. Other origins ({}) will be ignored.",
                            copied.stream()
                                  .filter(c -> !ANY_ORIGIN.equals(c))
                                  .collect(Collectors.joining(",")));
            }
        }
        return copied;
    }
Sets the regex pattern to evaluate whether an origin is allowed. The same-origin is allowed by default.

@see <a href="https://datatracker.ietf.org/doc/html/rfc6455#section-10.2">Origin Considerations</a>
core/src/main/java/com/linecorp/armeria/server/websocket/WebSocketServiceBuilder.java