EventController { void checkOrigin(String origin) { if (allowAllOrigins) return; for (String allowedOrigin : allowedOrigins) { if (origin.endsWith(allowedOrigin)) return; } throw new ForbiddenException("access denied"); } EventController(List<String> allowedOrigins, List<String> collectCookies); Response options(Request request); Response post(Request request);  }
@Test void checkOriginWithWildcard() { var controller = new EventController(List.of("*"), null); controller.checkOrigin("https: }
@Test void checkOrigin() { var controller = new EventController(List.of("localhost", "example.com"), null); controller.checkOrigin("https: controller.checkOrigin("https: assertThatThrownBy(() -> controller.checkOrigin("https: .isInstanceOf(ForbiddenException.class) .hasMessageContaining("access denied"); }