def METHOD_NAME(self):
    # https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet
    #     #Checking_The_Referer_Header
    origin = self.request.headers.get('origin') + '/'
    expected = self.request.host_url + '/'
    if not (origin and origin == expected):
        logging.error('csrf check failed for %s, origin: %r', self.request.url, origin)
        self.abort(403)