src/com/thetransactioncompany/cors/CORSRequestHandler.java
public void handleActualRequest(final HttpServletRequest request, final HttpServletResponse response)
		throws InvalidCORSRequestException, 
		       CORSOriginDeniedException, 
		       UnsupportedHTTPMethodException {
	
		if (CORSRequestType.detect(request) != CORSRequestType.ACTUAL)
			throw new InvalidCORSRequestException("Invalid simple/actual CORS request");
		
		
		// Check origin against allow list
		Origin requestOrigin = new Origin(request.getHeader("Origin"));
		
		if (! config.isAllowedOrigin(requestOrigin))
			throw new CORSOriginDeniedException("CORS origin denied", requestOrigin);
		
		
		// Check method
		
		HTTPMethod method = null;
		
		try {
			method = HTTPMethod.valueOf(request.getMethod());
			
		} catch (Exception e) {
			// Parse exception
			throw new UnsupportedHTTPMethodException("Unsupported HTTP method: " + request.getMethod());
		}
		
		if (! config.isSupportedMethod(method))
			throw new UnsupportedHTTPMethodException("Unsupported HTTP method", method);
		
		
		// Success, append response headers
		
		response.addHeader("Access-Control-Allow-Origin", requestOrigin.toString());
		
		if (config.supportsCredentials)
			response.addHeader("Access-Control-Allow-Credentials", "true");
		
		if (! exposedHeaders.isEmpty())
			response.addHeader("Access-Control-Expose-Headers", exposedHeaders);
		
		
		// Tag request
		request.setAttribute("cors.origin", requestOrigin.toString());
		request.setAttribute("cors.requestType", "actual");
	}
public void handleActualRequest(final HttpServletRequest request, final HttpServletResponse response)
		throws InvalidCORSRequestException, 
		       CORSOriginDeniedException, 
		       UnsupportedHTTPMethodException {
	
		if (CORSRequestType.detect(request) != CORSRequestType.ACTUAL)
			throw new InvalidCORSRequestException("Invalid simple/actual CORS request");
		
		
		// Check origin against allow list
		Origin requestOrigin = new Origin(request.getHeader("Origin"));
		
		if (! config.isAllowedOrigin(requestOrigin))
			throw new CORSOriginDeniedException("CORS origin denied", requestOrigin);
		
		
		// Check method
		
		HTTPMethod method = null;
		
		try {
			method = HTTPMethod.valueOf(request.getMethod());
			
		} catch (Exception e) {
			// Parse exception
			throw new UnsupportedHTTPMethodException("Unsupported HTTP method: " + request.getMethod());
		}
		
		if (! config.isSupportedMethod(method))
			throw new UnsupportedHTTPMethodException("Unsupported HTTP method", method);
		
		
		// Success, append response headers
		
		response.addHeader("Access-Control-Allow-Origin", requestOrigin.toString());
		
		if (config.supportsCredentials)
			response.addHeader("Access-Control-Allow-Credentials", "true");
		
		if (! exposedHeaders.isEmpty())
			response.addHeader("Access-Control-Expose-Headers", exposedHeaders);
		
		
		// Tag request
		request.setAttribute("cors.origin", requestOrigin.toString());
		request.setAttribute("cors.requestType", "actual");
	}
public void handleActualRequest ( final HttpServletRequest request , final HttpServletResponse response ) throws InvalidCORSRequestException , CORSOriginDeniedException , UnsupportedHTTPMethodException { if ( CORSRequestType . detect ( request ) != CORSRequestType . ACTUAL ) throw new InvalidCORSRequestException ( "Invalid simple/actual CORS request" ) ; // Check origin against allow list Origin requestOrigin = new Origin ( request . getHeader ( "Origin" ) ) ; if ( ! config . isAllowedOrigin ( requestOrigin ) ) throw new CORSOriginDeniedException ( "CORS origin denied" , requestOrigin ) ; // Check method HTTPMethod method = null ; try { method = HTTPMethod . valueOf ( request . getMethod ( ) ) ; } catch ( Exception e ) { // Parse exception throw new UnsupportedHTTPMethodException ( "Unsupported HTTP method: " + request . getMethod ( ) ) ; } if ( ! config . isSupportedMethod ( method ) ) throw new UnsupportedHTTPMethodException ( "Unsupported HTTP method" , method ) ; // Success, append response headers response . addHeader ( "Access-Control-Allow-Origin" , requestOrigin . toString ( ) ) ; if ( config . supportsCredentials ) response . addHeader ( "Access-Control-Allow-Credentials" , "true" ) ; if ( ! exposedHeaders . isEmpty ( ) ) response . addHeader ( "Access-Control-Expose-Headers" , exposedHeaders ) ; // Tag request request . setAttribute ( "cors.origin" , requestOrigin . toString ( ) ) ; request . setAttribute ( "cors.requestType" , "actual" ) ; }
Handles a simple or actual CORS request.

<p>CORS specification: <a href="http://www.w3.org/TR/access-control/#resource-requests">Simple Cross-Origin Request, Actual Request, and Redirects</a>

@param request  The HTTP request.
@param response The HTTP response.

@throws InvalidCORSRequestException    If not a valid CORS simple/
actual request.
@throws CORSOriginDeniedException      If the origin is not allowed.
@throws UnsupportedHTTPMethodException If the requested HTTP method
is not supported by the CORS
policy.
Handles a simple or actual CORS request .