AuthorizationServerFilter implements Filter { @Override public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest) servletRequest; HttpServletResponse response = (HttpServletResponse) servletResponse; if (handledCorsPreflightRequest(request, response)) { return; } final String accessToken = getAccessToken(request); if (accessToken != null) { VerifyTokenResponse tokenResponse = getVerifyTokenResponse(accessToken); if (isValidResponse(tokenResponse)) { request.setAttribute(VERIFY_TOKEN_RESPONSE, tokenResponse); chain.doFilter(request, response); return; } } sendError(response, HttpServletResponse.SC_FORBIDDEN, "OAuth2 endpoint"); }  @Override void init(FilterConfig filterConfig); @Override void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain); @Override void destroy(); void setAuthorizationServerUrl(String authorizationServerUrl); void setResourceServerSecret(String resourceServerSecret); void setResourceServerKey(String resourceServerKey); void setCacheEnabled(boolean cacheEnabled); void setAllowCorsRequests(boolean allowCorsRequests); void setTypeInformationIsIncluded(boolean typeInformationIsIncluded); static final String VERIFY_TOKEN_RESPONSE; }
@Test public void testCorsHeadersPreflight() throws IOException, ServletException { MockHttpServletRequest request = new MockHttpServletRequest(); request.addHeader(HttpHeaders.AUTHORIZATION, "bearer dummy-access-token"); request.addHeader("Origin", "http: request.addHeader("Access-Control-Request-Method", "PATCH"); request.addHeader("Access-Control-Request-Headers", HttpHeaders.AUTHORIZATION + ", X-Custom-Header"); request.setMethod("OPTIONS"); MockHttpServletResponse response = new MockHttpServletResponse(); filter.doFilter(request, response, null); assertEquals("86400", response.getHeader("Access-Control-Max-Age")); assertEquals(HttpHeaders.AUTHORIZATION + ", X-Custom-Header", response.getHeader("Access-Control-Allow-Headers")); assertEquals("GET, OPTIONS, HEAD, PUT, PATCH, POST, DELETE", response.getHeader("Access-Control-Allow-Methods")); assertEquals("*", response.getHeader("Access-Control-Allow-Origin")); }