EventController { public Response post(Request request) { String origin = request.header("Origin").orElse(null); if (origin != null) checkOrigin(origin); processEvents(request, Instant.now()); Response response = Response.empty(); if (origin != null) { response.header("Access-Control-Allow-Origin", origin); response.header("Access-Control-Allow-Credentials", "true"); } return response; } EventController(List<String> allowedOrigins, List<String> collectCookies); Response options(Request request); Response post(Request request);  }
@Test void post() { when(request.header("Origin")).thenReturn(Optional.of("localhost")); when(request.body()).thenReturn(Optional.empty()); var controller = new EventController(List.of("localhost"), null); Response response = controller.post(request); assertThat(response.header("Access-Control-Allow-Origin")).get().isEqualTo("localhost"); assertThat(response.header("Access-Control-Allow-Credentials")).get().isEqualTo("true"); }