class_docstr: Subclass of falcon-cors CORSMiddleware class.
  
  Generate a HTTP 403 Forbidden response if request sender is not allowed
  to access requested content.
  
  Default middleware just prints a message in server side
  (e.g. "Aborting response due to origin not allowed"), but still
  sends content, so, a client ignoring headers might still access
  data even if not allowed.
  
  CORS middleware role is to add necessary "access-control-" headers to
  response to mark it as allowed. So, a response lacking expected headers
  after call to parent method `process_ressource()` can be considered
  to not be delivered to request sender.
  
  More info about CORS:
  - https://developer.mozilla.org/fr/docs/Web/HTTP/CORS
  - https://fr.wikipedia.org/wiki/Cross-origin_resource_sharing
class_docstr_tok: ["Subclass","of","falcon-cors","CORSMiddleware","class",".","Generate","a","HTTP","403","Forbidden","response","if","request","sender","is","not","allowed","to","access","requested","content",".","Default","middleware","just","prints","a","message","in","server","side","(","e.g",".","``","Aborting","response","due","to","origin","not","allowed","''",")",",","but","still","sends","content",",","so",",","a","client","ignoring","headers","might","still","access","data","even","if","not","allowed",".","CORS","middleware","role","is","to","add","necessary","``","access-control-","''","headers","to","response","to","mark","it","as","allowed",".","So",",","a","response","lacking","expected","headers","after","call","to","parent","method","`","process_ressource","(",")","`","can","be","considered","to","not","be","delivered","to","request","sender",".","More","info","about","CORS",":","-","https",":","\/\/developer.mozilla.org\/fr\/docs\/Web\/HTTP\/CORS","-","https",":","\/\/fr.wikipedia.org\/wiki\/Cross-origin_resource_sharing"]
docstr: Generate a 403 Forbidden response if response is not allowed.
docstr_tok: ["Generate","a","403","Forbidden","response","if","response","is","not","allowed","."]
code: def process_resource(self, req, resp, resource, *args):
      """Generate a 403 Forbidden response if response is not allowed."""
  
      cors_resp_headers_before = [
          header
          for header in resp.headers
          if header.lower().startswith("access-control-")
      ]
      assert not cors_resp_headers_before, cors_resp_headers_before
  
      super().process_resource(req, resp, resource, *args)
  
      # We then verify if some access control headers were added to response.
      # If not, response is not allowed.
      # Special case: if request did not have an origin, it was certainly sent from
      # a browser (ie. not another server), so CORS is not relevant.
      cors_resp_headers_after = [
          header
          for header in resp.headers
          if header.lower().startswith("access-control-")
      ]
      if not cors_resp_headers_after and req.get_header("origin"):
          raise falcon.HTTPForbidden()
  
file_path: orion/src/orion/serving/webapi.py
imports: import logging
  import falcon
  from falcon_cors import CORS, CORSMiddleware
  from orion.serving.benchmarks_resource import BenchmarksResource
  from orion.serving.experiments_resource import ExperimentsResource
  from orion.serving.plots_resources import PlotsResource
  from orion.serving.runtime import RuntimeResource
  from orion.serving.storage_resource import StorageResource
  from orion.serving.trials_resource import TrialsResource
label_desc: Use image node_id 1 for calling the MyCORSMiddleware obj's underlying member method code with example usage: obj.process_resource(req, resp, resource) without return types