CorsRequestFilterBase extends JsonSecurityRequestFilterBase { @Override public final Optional<ErrorResponse> filter(DiscFilterRequest request) { Optional<ErrorResponse> errorResponse = filterRequest(request); errorResponse.ifPresent(response -> addCorsHeaders(request, response.getResponse())); return errorResponse; } protected  CorsRequestFilterBase(Set<String> allowedUrls); @Override final Optional<ErrorResponse> filter(DiscFilterRequest request);  }
@Test public void adds_cors_headers_when_filter_reject_request() { String origin = "http: Set<String> allowedOrigins = Collections.singleton(origin); int statusCode = 403; SimpleCorsRequestFilter filter = new SimpleCorsRequestFilter(allowedOrigins, statusCode, "Forbidden"); DiscFilterRequest request = mock(DiscFilterRequest.class); when(request.getHeader("Origin")).thenReturn(origin); MockResponseHandler responseHandler = new MockResponseHandler(); filter.filter(request, responseHandler); Response response = responseHandler.getResponse(); assertThat(response, notNullValue()); assertThat(response.getStatus(), equalTo(statusCode)); List<String> allowOriginHeader = response.headers().get(ALLOW_ORIGIN_HEADER); assertThat(allowOriginHeader.size(), equalTo(1)); assertThat(allowOriginHeader.get(0), equalTo(origin)); }