qbit/core/src/main/java/io/advantageous/qbit/http/server/CorsResponseDecorator.java
protected boolean handlePreflightCORS(final HttpRequestHolder request,
                                          final HttpResponseHolder response) {

        CORSRequestType requestType = checkRequestType(request);
        if (requestType != CORSRequestType.PRE_FLIGHT) {
            throw new IllegalArgumentException(CorsSupport.CORS_WRONG_TYPE_2);
            //TODO: String replace into above CORSRequestType.PRE_FLIGHT.name().toLowerCase(Locale.ENGLISH)));
        }

        final String origin = request.getHeaders().get(CorsResponseDecorator.REQUEST_HEADER_ORIGIN);

        // Section 6.2.2
        if (!isOriginAllowed(origin)) {
            handleInvalidCORS(request, response);
            return false;
        }

        // Section 6.2.3
        String accessControlRequestMethod = request.getHeaders().get(
                CorsResponseDecorator.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD);
        if (accessControlRequestMethod == null) {
            handleInvalidCORS(request, response);
            return false;
        } else {
            accessControlRequestMethod = accessControlRequestMethod.trim();
        }

        // Section 6.2.4
        String accessControlRequestHeadersHeader = request.getHeaders().get(
                CorsResponseDecorator.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS);
        List<String> accessControlRequestHeaders = new LinkedList<>();
        if (accessControlRequestHeadersHeader != null &&
                !accessControlRequestHeadersHeader.trim().isEmpty()) {
            String[] headers = accessControlRequestHeadersHeader.trim().split(
                    ",");
            for (String header : headers) {
                accessControlRequestHeaders.add(header.trim().toLowerCase(Locale.ENGLISH));
            }
        }

        // Section 6.2.5
        if (!corsSupport.getAllowedHeaders().contains(accessControlRequestMethod)) {
            handleInvalidCORS(request, response);
            return false;
        }

        // Section 6.2.6
        if (!accessControlRequestHeaders.isEmpty()) {
            for (String header : accessControlRequestHeaders) {
                if (!corsSupport.getAllowedHeaders().contains(header)) {
                    handleInvalidCORS(request, response);
                    return false;
                }
            }
        }

        // Section 6.2.7
        if (corsSupport.isAllowCredentials()) {
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                    origin);
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS,
                    "true");
        } else {
            if (anyOriginAllowed) {
                response.getHeaders().add(
                        CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                        "*");
            } else {
                response.getHeaders().add(
                        CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                        origin);
            }
        }

        // Section 6.2.8
        if (preFlightMaxAge > 0) {
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_MAX_AGE,
                    String.valueOf(preFlightMaxAge));
        }

        // Section 6.2.9
        response.getHeaders().add(
                CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_METHODS,
                accessControlRequestMethod);

        // Section 6.2.10
        if ((corsSupport.getAllowedHeaders() != null) && (!corsSupport.getAllowedHeaders().isEmpty())) {
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_HEADERS,
                    join(corsSupport.getAllowedHeaders(), ","));
        }

        return true;

    }
protected boolean handlePreflightCORS(final HttpRequestHolder request,
                                          final HttpResponseHolder response) {

        CORSRequestType requestType = checkRequestType(request);
        if (requestType != CORSRequestType.PRE_FLIGHT) {
            throw new IllegalArgumentException(CorsSupport.CORS_WRONG_TYPE_2);
            //TODO: String replace into above CORSRequestType.PRE_FLIGHT.name().toLowerCase(Locale.ENGLISH)));
        }

        final String origin = request.getHeaders().get(CorsResponseDecorator.REQUEST_HEADER_ORIGIN);

        // Section 6.2.2
        if (!isOriginAllowed(origin)) {
            handleInvalidCORS(request, response);
            return false;
        }

        // Section 6.2.3
        String accessControlRequestMethod = request.getHeaders().get(
                CorsResponseDecorator.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD);
        if (accessControlRequestMethod == null) {
            handleInvalidCORS(request, response);
            return false;
        } else {
            accessControlRequestMethod = accessControlRequestMethod.trim();
        }

        // Section 6.2.4
        String accessControlRequestHeadersHeader = request.getHeaders().get(
                CorsResponseDecorator.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS);
        List<String> accessControlRequestHeaders = new LinkedList<>();
        if (accessControlRequestHeadersHeader != null &&
                !accessControlRequestHeadersHeader.trim().isEmpty()) {
            String[] headers = accessControlRequestHeadersHeader.trim().split(
                    ",");
            for (String header : headers) {
                accessControlRequestHeaders.add(header.trim().toLowerCase(Locale.ENGLISH));
            }
        }

        // Section 6.2.5
        if (!corsSupport.getAllowedHeaders().contains(accessControlRequestMethod)) {
            handleInvalidCORS(request, response);
            return false;
        }

        // Section 6.2.6
        if (!accessControlRequestHeaders.isEmpty()) {
            for (String header : accessControlRequestHeaders) {
                if (!corsSupport.getAllowedHeaders().contains(header)) {
                    handleInvalidCORS(request, response);
                    return false;
                }
            }
        }

        // Section 6.2.7
        if (corsSupport.isAllowCredentials()) {
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                    origin);
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS,
                    "true");
        } else {
            if (anyOriginAllowed) {
                response.getHeaders().add(
                        CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                        "*");
            } else {
                response.getHeaders().add(
                        CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                        origin);
            }
        }

        // Section 6.2.8
        if (preFlightMaxAge > 0) {
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_MAX_AGE,
                    String.valueOf(preFlightMaxAge));
        }

        // Section 6.2.9
        response.getHeaders().add(
                CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_METHODS,
                accessControlRequestMethod);

        // Section 6.2.10
        if ((corsSupport.getAllowedHeaders() != null) && (!corsSupport.getAllowedHeaders().isEmpty())) {
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_HEADERS,
                    join(corsSupport.getAllowedHeaders(), ","));
        }

        return true;

    }
protected boolean handlePreflightCORS ( final HttpRequestHolder request , final HttpResponseHolder response ) { CORSRequestType requestType = checkRequestType ( request ) ; if ( requestType != CORSRequestType . PRE_FLIGHT ) { throw new IllegalArgumentException ( CorsSupport . CORS_WRONG_TYPE_2 ) ; //TODO: String replace into above CORSRequestType.PRE_FLIGHT.name().toLowerCase(Locale.ENGLISH))); } final String origin = request . getHeaders ( ) . get ( CorsResponseDecorator . REQUEST_HEADER_ORIGIN ) ; // Section 6.2.2 if ( ! isOriginAllowed ( origin ) ) { handleInvalidCORS ( request , response ) ; return false ; } // Section 6.2.3 String accessControlRequestMethod = request . getHeaders ( ) . get ( CorsResponseDecorator . REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD ) ; if ( accessControlRequestMethod == null ) { handleInvalidCORS ( request , response ) ; return false ; } else { accessControlRequestMethod = accessControlRequestMethod . trim ( ) ; } // Section 6.2.4 String accessControlRequestHeadersHeader = request . getHeaders ( ) . get ( CorsResponseDecorator . REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS ) ; List < String > accessControlRequestHeaders = new LinkedList <> ( ) ; if ( accessControlRequestHeadersHeader != null && ! accessControlRequestHeadersHeader . trim ( ) . isEmpty ( ) ) { String [ ] headers = accessControlRequestHeadersHeader . trim ( ) . split ( "," ) ; for ( String header : headers ) { accessControlRequestHeaders . add ( header . trim ( ) . toLowerCase ( Locale . ENGLISH ) ) ; } } // Section 6.2.5 if ( ! corsSupport . getAllowedHeaders ( ) . contains ( accessControlRequestMethod ) ) { handleInvalidCORS ( request , response ) ; return false ; } // Section 6.2.6 if ( ! accessControlRequestHeaders . isEmpty ( ) ) { for ( String header : accessControlRequestHeaders ) { if ( ! corsSupport . getAllowedHeaders ( ) . contains ( header ) ) { handleInvalidCORS ( request , response ) ; return false ; } } } // Section 6.2.7 if ( corsSupport . isAllowCredentials ( ) ) { response . getHeaders ( ) . add ( CorsResponseDecorator . RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN , origin ) ; response . getHeaders ( ) . add ( CorsResponseDecorator . RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS , "true" ) ; } else { if ( anyOriginAllowed ) { response . getHeaders ( ) . add ( CorsResponseDecorator . RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN , "*" ) ; } else { response . getHeaders ( ) . add ( CorsResponseDecorator . RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN , origin ) ; } } // Section 6.2.8 if ( preFlightMaxAge > 0 ) { response . getHeaders ( ) . add ( CorsResponseDecorator . RESPONSE_HEADER_ACCESS_CONTROL_MAX_AGE , String . valueOf ( preFlightMaxAge ) ) ; } // Section 6.2.9 response . getHeaders ( ) . add ( CorsResponseDecorator . RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_METHODS , accessControlRequestMethod ) ; // Section 6.2.10 if ( ( corsSupport . getAllowedHeaders ( ) != null ) && ( ! corsSupport . getAllowedHeaders ( ) . isEmpty ( ) ) ) { response . getHeaders ( ) . add ( CorsResponseDecorator . RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_HEADERS , join ( corsSupport . getAllowedHeaders ( ) , "," ) ) ; } return true ; }
Handles CORS pre-flight request.

@param request  request
@param response response
@return return true if pre flight handler.
Handles CORS pre - flight request .