RequestUtil { public static Boolean isCrossOriginRequest( final ContainerRequestContext request) throws InvalidHostException { URI origin = getOrigin(request); URI referer = getReferer(request); URI host = getHost(request); URI forwardedHost = getForwardedHost(request); try { referer = new URIBuilder() .setScheme(referer.getScheme()) .setHost(referer.getHost()) .setPort(referer.getPort()) .build(); } catch (NullPointerException | URISyntaxException e) { referer = null; } URI source = origin == null ? referer : origin; URI target = forwardedHost == null ? host : forwardedHost; if (source == null) { return false; } return !source.equals(target); } private  RequestUtil(); static String getCORSRequestedMethod(
            final ContainerRequestContext request); static List<String> getCORSRequestedHeaders(
            final ContainerRequestContext request); static URI getOrigin(final ContainerRequestContext request); static URI getReferer(final ContainerRequestContext request); static URI getHost(final ContainerRequestContext request); static URI getForwardedHost(
            final ContainerRequestContext request); static Boolean isCrossOriginRequest(
            final ContainerRequestContext request);  }
@Test public void testCrossOriginWithHost() throws Exception { MultivaluedMap<String, String> headers = new MultivaluedHashMap<>(); headers.add(HttpHeaders.HOST, "host.example.com"); ContainerRequestContext mockContext = buildContext( "http: headers ); Boolean result = RequestUtil.isCrossOriginRequest(mockContext); assertFalse(result); }
@Test public void testCrossOriginWithOriginAndHost() throws Exception { MultivaluedMap<String, String> headers = new MultivaluedHashMap<>(); headers.add(HttpHeaders.ORIGIN, "http: headers.add(HttpHeaders.HOST, "host.example.com"); ContainerRequestContext mockContext = buildContext( "http: headers ); Boolean result = RequestUtil.isCrossOriginRequest(mockContext); assertFalse(result); }
@Test public void testCrossOriginWithOriginAndHostMismatch() throws Exception { MultivaluedMap<String, String> headers = new MultivaluedHashMap<>(); headers.add(HttpHeaders.ORIGIN, "http: headers.add(HttpHeaders.HOST, "host.example.com"); ContainerRequestContext mockContext = buildContext( "https: headers ); Boolean result = RequestUtil.isCrossOriginRequest(mockContext); assertTrue(result); }
@Test public void testCrossOriginWithOriginAndForward() throws Exception { MultivaluedMap<String, String> headers = new MultivaluedHashMap<>(); headers.add(HttpHeaders.ORIGIN, "http: headers.add(HttpHeaders.X_FORWARDED_PROTO, "http"); headers.add(HttpHeaders.X_FORWARDED_PORT, "8080"); headers.add(HttpHeaders.X_FORWARDED_HOST, "example.com"); headers.add(HttpHeaders.HOST, "host.example.com"); ContainerRequestContext mockContext = buildContext( "http: headers ); Boolean result = RequestUtil.isCrossOriginRequest(mockContext); assertFalse(result); }
@Test public void testCrossOriginWithOriginAndForwardMismatch() throws Exception { MultivaluedMap<String, String> headers = new MultivaluedHashMap<>(); headers.add(HttpHeaders.ORIGIN, "http: headers.add(HttpHeaders.X_FORWARDED_PROTO, "http"); headers.add(HttpHeaders.X_FORWARDED_PORT, "8081"); headers.add(HttpHeaders.X_FORWARDED_HOST, "example.com"); headers.add(HttpHeaders.HOST, "host.example.com"); ContainerRequestContext mockContext = buildContext( "https: headers ); Boolean result = RequestUtil.isCrossOriginRequest(mockContext); assertTrue(result); }
@Test(expected = InvalidHostException.class) public void testCrossOriginWithOriginAndInvalidForward() throws Exception { MultivaluedMap<String, String> headers = new MultivaluedHashMap<>(); headers.add(HttpHeaders.ORIGIN, "http: headers.add(HttpHeaders.X_FORWARDED_PROTO, "http"); headers.add(HttpHeaders.X_FORWARDED_PORT, "string"); headers.add(HttpHeaders.X_FORWARDED_HOST, "example.com"); ContainerRequestContext mockContext = buildContext( "https: headers ); RequestUtil.isCrossOriginRequest(mockContext); }
@Test public void testCrossOriginWithReferrerAndHost() throws Exception { MultivaluedMap<String, String> headers = new MultivaluedHashMap<>(); headers.add(HttpHeaders.REFERER, "http: headers.add(HttpHeaders.HOST, "host.example.com"); ContainerRequestContext mockContext = buildContext( "http: headers ); Boolean result = RequestUtil.isCrossOriginRequest(mockContext); assertFalse(result); }
@Test public void testCrossOriginWithReferrerAndHostMismatch() throws Exception { MultivaluedMap<String, String> headers = new MultivaluedHashMap<>(); headers.add(HttpHeaders.REFERER, "http: headers.add(HttpHeaders.HOST, "another.example.com"); ContainerRequestContext mockContext = buildContext( "https: headers ); Boolean result = RequestUtil.isCrossOriginRequest(mockContext); assertTrue(result); }
@Test public void testCrossOriginWithReferrerAndForward() throws Exception { MultivaluedMap<String, String> headers = new MultivaluedHashMap<>(); headers.add(HttpHeaders.HOST, "proxied.example.com"); headers.add(HttpHeaders.REFERER, "http: headers.add(HttpHeaders.X_FORWARDED_PROTO, "http"); headers.add(HttpHeaders.X_FORWARDED_PORT, "8080"); headers.add(HttpHeaders.X_FORWARDED_HOST, "example.com"); ContainerRequestContext mockContext = buildContext( "https: headers ); Boolean result = RequestUtil.isCrossOriginRequest(mockContext); assertFalse(result); }
@Test public void testCrossOriginWithReferrerAndForwardMisMatch() throws Exception { MultivaluedMap<String, String> headers = new MultivaluedHashMap<>(); headers.add(HttpHeaders.HOST, "proxy.example.com"); headers.add(HttpHeaders.REFERER, "http: headers.add(HttpHeaders.X_FORWARDED_PROTO, "http"); headers.add(HttpHeaders.X_FORWARDED_HOST, "another.example.com"); ContainerRequestContext mockContext = buildContext( "https: headers ); Boolean result = RequestUtil.isCrossOriginRequest(mockContext); assertTrue(result); }
@Test(expected = InvalidHostException.class) public void testCrossOriginWithReferrerAndInvalidForward() throws Exception { MultivaluedMap<String, String> headers = new MultivaluedHashMap<>(); headers.add(HttpHeaders.REFERER, "http: headers.add(HttpHeaders.X_FORWARDED_PROTO, "http"); headers.add(HttpHeaders.X_FORWARDED_PORT, "string"); headers.add(HttpHeaders.X_FORWARDED_HOST, "example.com"); ContainerRequestContext mockContext = buildContext( "https: headers ); RequestUtil.isCrossOriginRequest(mockContext); }
@Test(expected = InvalidHostException.class) public void testCrossOriginNoOriginOrReferrer() throws Exception { MultivaluedMap<String, String> headers = new MultivaluedHashMap<>(); headers.add(HttpHeaders.X_FORWARDED_PROTO, "http"); headers.add(HttpHeaders.X_FORWARDED_PORT, "string"); headers.add(HttpHeaders.X_FORWARDED_HOST, "example.com"); ContainerRequestContext mockContext = buildContext( "https: headers ); RequestUtil.isCrossOriginRequest(mockContext); }
@Test(expected = InvalidHostException.class) public void testCrossOriginNoHostOrForward() throws Exception { MultivaluedMap<String, String> headers = new MultivaluedHashMap<>(); headers.add(HttpHeaders.ORIGIN, "http: ContainerRequestContext mockContext = buildContext( "https: headers ); RequestUtil.isCrossOriginRequest(mockContext); }