CORSResponseFilter implements Filter { public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest httpRequest = (HttpServletRequest) request; HttpServletResponse httpResponse = (HttpServletResponse) response; SettingManager settingManager = ApplicationContextHolder.get().getBean(SettingManager.class); if (isUsingDb) { String allowedHosts = settingManager.getValue(SYSTEM_CORS_ALLOWEDHOSTS); if (allowedHosts != null) { if (allowedHosts.equals("*")) { addHeaderForAllHosts = true; } else if (!allowedHosts.equals("")) { addHeaderForAllHosts = false; allowedRemoteHosts = Arrays.asList(allowedHosts.split(",")); } } } if (addHeaderForAllHosts || allowedRemoteHosts.size() > 0) { String clientOriginUrl = httpRequest.getHeader("origin"); if (clientOriginUrl != null) { try { String clientOriginHost = new java.net.URI(clientOriginUrl).getHost(); String myHost = settingManager.getValue(Settings.SYSTEM_SERVER_HOST); if (addHeaderForAllHosts || allowedRemoteHosts.indexOf(clientOriginHost) != -1 || clientOriginHost.equals(myHost)) { httpResponse.setHeader("Access-Control-Allow-Origin", "*"); httpResponse.setHeader("Access-Control-Allow-Headers", "X-Requested-With, Content-Type"); httpResponse.setHeader("Access-Control-Allow-Credentials", "true"); httpResponse.setHeader("Vary", "Origin"); } } catch (Exception e) { Log.warning(Geonet.CORS, String.format( "An error occurs (%s) while getting the host of the origin header (ie. '%s') of the incoming request. CORS header not added.", e.getMessage(), clientOriginUrl)); } } } chain.doFilter(request, httpResponse); }  void init(FilterConfig config); void doFilter(ServletRequest request, ServletResponse response, FilterChain chain); synchronized void destroy();  }
@Test public void testCorsHeaderNotAddedWhenNone() throws IOException, ServletException { HttpServletRequest httpServletRequest = mock(HttpServletRequest.class); HttpServletResponse httpServletResponse = spy(new MockHttpServletResponse()); FilterChain filterChain = mock(FilterChain.class); when(httpServletRequest.getHeader("origin")).thenReturn("http: buildFilter("").doFilter(httpServletRequest, httpServletResponse, filterChain); assertNull(httpServletResponse.getHeader("Access-Control-Allow-Origin")); }
@Test public void testCorsHeaderAddedToAllWhenStar() throws IOException, ServletException { HttpServletRequest httpServletRequest = mock(HttpServletRequest.class); HttpServletResponse httpServletResponse = spy(new MockHttpServletResponse()); FilterChain filterChain = mock(FilterChain.class); when(httpServletRequest.getHeader("origin")).thenReturn("http: buildFilter("*").doFilter(httpServletRequest, httpServletResponse, filterChain); assertEquals("*", httpServletResponse.getHeader("Access-Control-Allow-Origin")); }
@Test public void testCorsHeaderAddedToAllowedHostOnly() throws IOException, ServletException { HttpServletRequest httpServletRequest = mock(HttpServletRequest.class); HttpServletResponse httpServletResponse = spy(new MockHttpServletResponse()); FilterChain filterChain = mock(FilterChain.class); CORSResponseFilter filter = buildFilter("www.geonetwork-opensource.org,osgeo.org"); when(httpServletRequest.getHeader("origin")).thenReturn("http: filter.doFilter(httpServletRequest, httpServletResponse, filterChain); assertEquals("*", httpServletResponse.getHeader("Access-Control-Allow-Origin")); httpServletResponse = spy(new MockHttpServletResponse()); when(httpServletRequest.getHeader("origin")).thenReturn("http: filter.doFilter(httpServletRequest, httpServletResponse, filterChain); assertEquals("*", httpServletResponse.getHeader("Access-Control-Allow-Origin")); httpServletResponse = spy(new MockHttpServletResponse()); when(httpServletRequest.getHeader("origin")).thenReturn("http: filter.doFilter(httpServletRequest, httpServletResponse, filterChain); assertNull(httpServletResponse.getHeader("Access-Control-Allow-Origin")); }
@Test public void testCorsHeaderAddedBasedOnDb() throws IOException, ServletException { HttpServletRequest httpServletRequest = mock(HttpServletRequest.class); HttpServletResponse httpServletResponse = spy(new MockHttpServletResponse()); FilterChain filterChain = mock(FilterChain.class); when(httpServletRequest.getHeader("origin")).thenReturn("http: buildFilter("db").doFilter(httpServletRequest, httpServletResponse, filterChain); assertEquals("*", httpServletResponse.getHeader("Access-Control-Allow-Origin")); }