CorsHandler implements HttpHandler, HandlerWrapper { void handlePreflight(HttpServerExchange exchange) { HeaderMap requestHeaders = exchange.getRequestHeaders(); String origin = requestHeaders.getFirst(ORIGIN); String method = requestHeaders.getFirst(ACCESS_CONTROL_REQUEST_METHOD); String requestedHeaders = requestHeaders.getFirst(ACCESS_CONTROL_REQUEST_HEADERS); HeaderMap responseHeaders = exchange.getResponseHeaders(); responseHeaders.put(VARY, "origin,access-control-request-method,access-control-request-headers"); if ( ("POST".equals(method) || "GET".equals(method)) && requestedHeadersAllowed(requestedHeaders) && setOrigin(origin, responseHeaders) ) { responseHeaders.put(ACCESS_CONTROL_ALLOW_METHODS, method); if (requestedHeaders != null) { responseHeaders.put(ACCESS_CONTROL_ALLOW_HEADERS, requestedHeaders); } } } CorsHandler(String allowedOrigins); @Override void handleRequest(HttpServerExchange exchange); @Override HttpHandler wrap(HttpHandler handler);  }
@Test public void handlePreflight_allowsPOST() { handler = new CorsHandler("http: handlePreflight( ImmutableMap.of( "Origin", "http: "Access-Control-Request-Method", "POST"), ImmutableMap.of( "vary", "origin,access-control-request-method,access-control-request-headers", "access-control-allow-origin", "http: "access-control-allow-methods", "POST" ) ); }
@Test public void handlePreflight_disallowsDELETE() { handler = new CorsHandler("http: handlePreflight( ImmutableMap.of( "Origin", "http: "Access-Control-Request-Method", "DELETE"), ImmutableMap.of( "vary", "origin,access-control-request-method,access-control-request-headers" ) ); }
@Test public void handlePreflight_allowsContentType() { handler = new CorsHandler("http: handlePreflight( ImmutableMap.of( "Origin", "http: "Access-Control-Request-Method", "POST", "Access-Control-Request-Headers", "Content-Type, Content-Encoding"), ImmutableMap.of( "vary", "origin,access-control-request-method,access-control-request-headers", "access-control-allow-origin", "http: "access-control-allow-methods", "POST", "access-control-allow-headers", "Content-Type, Content-Encoding" ) ); }
@Test public void handlePreflight_disallowsAuthorization() { handler = new CorsHandler("http: handlePreflight( ImmutableMap.of( "Origin", "http: "Access-Control-Request-Method", "POST", "Access-Control-Request-Headers", "Content-Type, Authorization"), ImmutableMap.of( "vary", "origin,access-control-request-method,access-control-request-headers" ) ); }
@Test public void handlePreflight_allowsOrigin() { handler = new CorsHandler("http: handlePreflight( ImmutableMap.of( "Origin", "http: "Access-Control-Request-Method", "POST", "Access-Control-Request-Headers", "origin"), ImmutableMap.of( "vary", "origin,access-control-request-method,access-control-request-headers", "access-control-allow-origin", "http: "access-control-allow-methods", "POST", "access-control-allow-headers", "origin" ) ); }