We can use regex to match if the request' Origin header is in the allow list.
People who want to implement it can take a look at: https://github.com/apache/apisix/blob/master/apisix/plugins/uri-blocker.lua