CorsHandler { public void handle(HttpServletRequest request, HttpServletResponse response) { if (isValidMethod(request)) { allowOrigin(request, response); allowMethods(response); allowHeaders(request, response); setMaxAge(response); setAccessControlAllowCredentials(response); } }  void handle(HttpServletRequest request, HttpServletResponse response); static void allowOrigin(HttpServletRequest request, HttpServletResponse response); static void setAccessControlAllowCredentials(HttpServletResponse response); static final String ALLOWED_METHODS_STRING; }
@Test public void handle() { initializeValidRequest(request); handler.handle(request, response); assertThat(response.getStatus()).isEqualTo(HttpServletResponse.SC_OK); assertThat(response.getHeader("Access-Control-Allow-Origin")).isEqualTo(ORIGIN); assertThat(response.getHeader("Access-Control-Allow-Headers")).isEqualTo(TEST_HEADER); assertThat(response.getHeader("Access-Control-Max-Age")).isEqualTo("3600"); assertThat(response.getHeader("Access-Control-Allow-Credentials")).isEqualTo("true"); assertThat(COMMA_SPLITTER.split(response.getHeader("Access-Control-Allow-Methods"))) .containsExactly("HEAD", "DELETE", "GET", "PATCH", "POST", "PUT"); }
@Test public void handle_invalidMethod() { request.addHeader("Access-Control-Request-Method", "DEELEEETE"); request.addHeader("Access-Control-Request-Headers", TEST_HEADER); request.addHeader("Origin", ORIGIN); handler.handle(request, response); assertThat(response.getStatus()).isEqualTo(HttpServletResponse.SC_OK); assertThat(response.getHeader("Access-Control-Allow-Origin")).isNull(); assertThat(response.getHeader("Access-Control-Allow-Headers")).isNull(); assertThat(response.getHeader("Access-Control-Max-Age")).isNull(); assertThat(response.getHeader("Access-Control-Allow-Credentials")).isNull(); assertThat(response.getHeader("Access-Control-Allow-Methods")).isNull(); }