EventController { public Response options(Request request) { String origin = request.header("Origin").orElseThrow(() -> new ForbiddenException("access denied")); checkOrigin(origin); return Response.empty().status(HTTPStatus.OK) .header("Access-Control-Allow-Origin", origin) .header("Access-Control-Allow-Methods", "POST, PUT, OPTIONS") .header("Access-Control-Allow-Headers", "Accept, Content-Type") .header("Access-Control-Allow-Credentials", "true"); } EventController(List<String> allowedOrigins, List<String> collectCookies); Response options(Request request); Response post(Request request);  }
@Test void options() { when(request.header("Origin")).thenReturn(Optional.empty()); var controller = new EventController(List.of("*"), null); assertThatThrownBy(() -> controller.options(request)) .isInstanceOf(ForbiddenException.class); }
@Test void allowPOSTWithCORS() { when(request.header("Origin")).thenReturn(Optional.of("localhost")); var controller = new EventController(List.of("*"), null); assertThat(controller.options(request).header("Access-Control-Allow-Methods")) .hasValueSatisfying(methods -> assertThat(methods).contains("POST")); }