public boolean isAllowedOrigin(String origin, String host) {
        if (origin == null || host == null) {
            return false;
        }
        return (host.equals(origin) || allowOrigin.contains("*") || allowOrigin.contains(origin)); //$NON-NLS-1$
    }
Is allowed if: * (any), host == origin (not all browsers do this), is on allowed list.

@param host the host
@param origin the origin of request
@return true if origin is allowed
plugins/cors-policy/src/main/java/io/apiman/plugins/cors_policy/CorsConfigBean.java