def METHOD_NAME(f):
    """
    Add CORS headers to the decorated view function.
    Requires `app.config['ALLOWED_ORIGINS']` to be defined with a list
    of permitted domains. Eg: app.config['ALLOWED_ORIGINS'] = ['https://example.com']
    """
    def add_headers(resp, origin):
        resp.headers['Access-Control-Allow-Origin'] = origin
        resp.headers['Access-Control-Allow-Methods'] = 'POST, OPTIONS, GET'
        # echo the request's headers
        resp.headers['Access-Control-Allow-Headers'] = request.headers.get(
            'Access-Control-Request-Headers'
        )
        # debugging only
        if app.debug:
            resp.headers['Access-Control-Max-Age'] = '1'
        return resp
    @wraps(f)
    def wrapper(*args, **kwargs):
        origin = request.headers.get('Origin')
        if not origin:
            # Firefox doesn't send the Origin header, so read the Referer header instead
            # TODO: Remove this conditional when Firefox starts adding an Origin header
            referer = request.referrer
            if referer:
                origin = basepath(referer)
        if (
            request.method == 'POST'
            and not origin
            or origin not in app.config['ALLOWED_ORIGINS']
        ):
            abort(401)
        if request.method == 'OPTIONS':
            # pre-flight request, check CORS headers directly
            resp = app.make_default_options_response()
        else:
            resp = f(*args, **kwargs)
        return add_headers(resp, origin)
    return wrapper