src/com/thetransactioncompany/cors/CORSRequestHandler.java
public void handlePreflightRequest(final HttpServletRequest request, final HttpServletResponse response)
		throws InvalidCORSRequestException, 
		       CORSOriginDeniedException, 
		       UnsupportedHTTPMethodException, 
		       UnsupportedHTTPHeaderException {
		
		if (CORSRequestType.detect(request) != CORSRequestType.PREFLIGHT)
			throw new InvalidCORSRequestException("Invalid preflight CORS request");
		
		// Check origin against allow list
		Origin requestOrigin = new Origin(request.getHeader("Origin"));
		
		if (! config.isAllowedOrigin(requestOrigin))
			throw new CORSOriginDeniedException("CORS origin denied", requestOrigin);
			
		
		// Parse requested method
		// Note: method checking must be done after header parsing, see CORS spec
		
		String requestMethodHeader = request.getHeader("Access-Control-Request-Method");
		
		if (requestMethodHeader == null)
			throw new InvalidCORSRequestException("Invalid preflight CORS request: Missing Access-Control-Request-Method header");
		
		HTTPMethod requestedMethod = null;
		
		try {
			requestedMethod = HTTPMethod.valueOf(requestMethodHeader.toUpperCase());
			
		} catch (Exception e) {
			// Parse exception
			throw new UnsupportedHTTPMethodException("Unsupported HTTP method: " + requestMethodHeader);
		}
		
		
		// Parse custom headers
		
		final String[] requestHeaderValues = parseMultipleHeaderValues(request.getHeader("Access-Control-Request-Headers"));
		
		final HeaderFieldName[] requestHeaders = new HeaderFieldName[requestHeaderValues.length];
		
		for (int i=0; i<requestHeaders.length; i++) {
		
			try {
				requestHeaders[i] = new HeaderFieldName(requestHeaderValues[i]);
				
			} catch (IllegalArgumentException e) {
				// Invalid header name
				throw new InvalidCORSRequestException("Invalid preflight CORS request: Bad request header value");
			}
		}
		
		
		// Now, do method check
		if (! config.isSupportedMethod(requestedMethod))
			throw new UnsupportedHTTPMethodException("Unsupported HTTP method", requestedMethod);
		
		
		// Author request headers check
		
		for (int i=0; i<requestHeaders.length; i++) {
		
			if (! config.supportedHeaders.contains(requestHeaders[i]))
				throw new UnsupportedHTTPHeaderException("Unsupported HTTP request header", requestHeaders[i]);
				
		}
		
		// Success, append response headers
		
		if (config.supportsCredentials) {
			response.addHeader("Access-Control-Allow-Origin", requestOrigin.toString());
			response.addHeader("Access-Control-Allow-Credentials", "true");
		}
		else {
			if (config.allowAnyOrigin)
				response.addHeader("Access-Control-Allow-Origin", "*");
			else
				response.addHeader("Access-Control-Allow-Origin", requestOrigin.toString());
		}
		
		if (config.maxAge > 0)
			response.addHeader("Access-Control-Max-Age", Integer.toString(config.maxAge));
		
		response.addHeader("Access-Control-Allow-Methods", supportedMethods);
		
		if (! supportedHeaders.isEmpty())
			response.addHeader("Access-Control-Allow-Headers", supportedHeaders);
	}
public void handlePreflightRequest(final HttpServletRequest request, final HttpServletResponse response)
		throws InvalidCORSRequestException, 
		       CORSOriginDeniedException, 
		       UnsupportedHTTPMethodException, 
		       UnsupportedHTTPHeaderException {
		
		if (CORSRequestType.detect(request) != CORSRequestType.PREFLIGHT)
			throw new InvalidCORSRequestException("Invalid preflight CORS request");
		
		// Check origin against allow list
		Origin requestOrigin = new Origin(request.getHeader("Origin"));
		
		if (! config.isAllowedOrigin(requestOrigin))
			throw new CORSOriginDeniedException("CORS origin denied", requestOrigin);
			
		
		// Parse requested method
		// Note: method checking must be done after header parsing, see CORS spec
		
		String requestMethodHeader = request.getHeader("Access-Control-Request-Method");
		
		if (requestMethodHeader == null)
			throw new InvalidCORSRequestException("Invalid preflight CORS request: Missing Access-Control-Request-Method header");
		
		HTTPMethod requestedMethod = null;
		
		try {
			requestedMethod = HTTPMethod.valueOf(requestMethodHeader.toUpperCase());
			
		} catch (Exception e) {
			// Parse exception
			throw new UnsupportedHTTPMethodException("Unsupported HTTP method: " + requestMethodHeader);
		}
		
		
		// Parse custom headers
		
		final String[] requestHeaderValues = parseMultipleHeaderValues(request.getHeader("Access-Control-Request-Headers"));
		
		final HeaderFieldName[] requestHeaders = new HeaderFieldName[requestHeaderValues.length];
		
		for (int i=0; i<requestHeaders.length; i++) {
		
			try {
				requestHeaders[i] = new HeaderFieldName(requestHeaderValues[i]);
				
			} catch (IllegalArgumentException e) {
				// Invalid header name
				throw new InvalidCORSRequestException("Invalid preflight CORS request: Bad request header value");
			}
		}
		
		
		// Now, do method check
		if (! config.isSupportedMethod(requestedMethod))
			throw new UnsupportedHTTPMethodException("Unsupported HTTP method", requestedMethod);
		
		
		// Author request headers check
		
		for (int i=0; i<requestHeaders.length; i++) {
		
			if (! config.supportedHeaders.contains(requestHeaders[i]))
				throw new UnsupportedHTTPHeaderException("Unsupported HTTP request header", requestHeaders[i]);
				
		}
		
		// Success, append response headers
		
		if (config.supportsCredentials) {
			response.addHeader("Access-Control-Allow-Origin", requestOrigin.toString());
			response.addHeader("Access-Control-Allow-Credentials", "true");
		}
		else {
			if (config.allowAnyOrigin)
				response.addHeader("Access-Control-Allow-Origin", "*");
			else
				response.addHeader("Access-Control-Allow-Origin", requestOrigin.toString());
		}
		
		if (config.maxAge > 0)
			response.addHeader("Access-Control-Max-Age", Integer.toString(config.maxAge));
		
		response.addHeader("Access-Control-Allow-Methods", supportedMethods);
		
		if (! supportedHeaders.isEmpty())
			response.addHeader("Access-Control-Allow-Headers", supportedHeaders);
	}
public void handlePreflightRequest ( final HttpServletRequest request , final HttpServletResponse response ) throws InvalidCORSRequestException , CORSOriginDeniedException , UnsupportedHTTPMethodException , UnsupportedHTTPHeaderException { if ( CORSRequestType . detect ( request ) != CORSRequestType . PREFLIGHT ) throw new InvalidCORSRequestException ( "Invalid preflight CORS request" ) ; // Check origin against allow list Origin requestOrigin = new Origin ( request . getHeader ( "Origin" ) ) ; if ( ! config . isAllowedOrigin ( requestOrigin ) ) throw new CORSOriginDeniedException ( "CORS origin denied" , requestOrigin ) ; // Parse requested method // Note: method checking must be done after header parsing, see CORS spec String requestMethodHeader = request . getHeader ( "Access-Control-Request-Method" ) ; if ( requestMethodHeader == null ) throw new InvalidCORSRequestException ( "Invalid preflight CORS request: Missing Access-Control-Request-Method header" ) ; HTTPMethod requestedMethod = null ; try { requestedMethod = HTTPMethod . valueOf ( requestMethodHeader . toUpperCase ( ) ) ; } catch ( Exception e ) { // Parse exception throw new UnsupportedHTTPMethodException ( "Unsupported HTTP method: " + requestMethodHeader ) ; } // Parse custom headers final String [ ] requestHeaderValues = parseMultipleHeaderValues ( request . getHeader ( "Access-Control-Request-Headers" ) ) ; final HeaderFieldName [ ] requestHeaders = new HeaderFieldName [ requestHeaderValues . length ] ; for ( int i = 0 ; i < requestHeaders . length ; i ++ ) { try { requestHeaders [ i ] = new HeaderFieldName ( requestHeaderValues [ i ] ) ; } catch ( IllegalArgumentException e ) { // Invalid header name throw new InvalidCORSRequestException ( "Invalid preflight CORS request: Bad request header value" ) ; } } // Now, do method check if ( ! config . isSupportedMethod ( requestedMethod ) ) throw new UnsupportedHTTPMethodException ( "Unsupported HTTP method" , requestedMethod ) ; // Author request headers check for ( int i = 0 ; i < requestHeaders . length ; i ++ ) { if ( ! config . supportedHeaders . contains ( requestHeaders [ i ] ) ) throw new UnsupportedHTTPHeaderException ( "Unsupported HTTP request header" , requestHeaders [ i ] ) ; } // Success, append response headers if ( config . supportsCredentials ) { response . addHeader ( "Access-Control-Allow-Origin" , requestOrigin . toString ( ) ) ; response . addHeader ( "Access-Control-Allow-Credentials" , "true" ) ; } else { if ( config . allowAnyOrigin ) response . addHeader ( "Access-Control-Allow-Origin" , "*" ) ; else response . addHeader ( "Access-Control-Allow-Origin" , requestOrigin . toString ( ) ) ; } if ( config . maxAge > 0 ) response . addHeader ( "Access-Control-Max-Age" , Integer . toString ( config . maxAge ) ) ; response . addHeader ( "Access-Control-Allow-Methods" , supportedMethods ) ; if ( ! supportedHeaders . isEmpty ( ) ) response . addHeader ( "Access-Control-Allow-Headers" , supportedHeaders ) ; }
Handles a preflight CORS request.

<p>CORS specification: <a href="http://www.w3.org/TR/access-control/#resource-preflight-requests">Preflight Request</a>

@param request  The HTTP request.
@param response The HTTP response.

@throws InvalidCORSRequestException    If not a valid CORS preflight
request.
@throws CORSOriginDeniedException      If the origin is not allowed.
@throws UnsupportedHTTPMethodException If the requested HTTP method
is not supported by the CORS
policy.
@throws UnsupportedHTTPHeaderException If the requested HTTP header
is not supported by the CORS
policy.
Handles a preflight CORS request .