@Test public void requestFilter_PreflightRequestGiven_NoCorsHeadersAdded() throws IOException { CorsFilter filter = new CorsFilter.Builder().build(); ContainerRequestContext request = createPreflightRequestMock(DEFAULT_HOST, DEFAULT_ORIGIN, "..."); ContainerResponseContext response = mock(ContainerResponseContext.class); filter.filter(request, response); verifyZeroInteractions(response); }
@Override public void filter(ContainerRequestContext requestContext) throws IOException { String origin = requestContext.getHeaderString(ORIGIN); if (origin == null) { return; } URI originUri = toUriSafe(origin); if (!isValidOrigin(originUri)) { throw prepareCorsFailureRequest(new ForbiddenException("invalid origin"), requestContext); } if (sameOriginPolicy.isSameOrigin(requestContext, origin)) { return; } String accessControlRequestMethod = requestContext.getHeaderString(ACCESS_CONTROL_REQUEST_METHOD); if (!isValidAccessControlRequestMethod(accessControlRequestMethod)) { throw prepareCorsFailureRequest(new ForbiddenException("accessControlRequestMethod may not be empty"), requestContext); } String requestMethod = requestContext.getMethod(); if (isPreflightRequest(requestMethod, accessControlRequestMethod)) { String accessControlRequestHeaders = requestContext.getHeaderString(ACCESS_CONTROL_REQUEST_HEADERS); WebApplicationException corsPreflightFailure = validateCorsPreflightRequest(origin, accessControlRequestMethod, accessControlRequestHeaders); if (corsPreflightFailure != null) { throw prepareCorsFailureRequest(corsPreflightFailure, requestContext); } else { requestContext.abortWith( buildPreflightResponse(origin, accessControlRequestMethod, accessControlRequestHeaders)); } } else { WebApplicationException corsActualRequestFailure = validateCorsActualRequest(origin, requestMethod); if (corsActualRequestFailure != null) { throw prepareCorsFailureRequest(corsActualRequestFailure, requestContext); } } }
CorsFilter implements ContainerRequestFilter, ContainerResponseFilter { @Override public void filter(ContainerRequestContext requestContext) throws IOException { String origin = requestContext.getHeaderString(ORIGIN); if (origin == null) { return; } URI originUri = toUriSafe(origin); if (!isValidOrigin(originUri)) { throw prepareCorsFailureRequest(new ForbiddenException("invalid origin"), requestContext); } if (sameOriginPolicy.isSameOrigin(requestContext, origin)) { return; } String accessControlRequestMethod = requestContext.getHeaderString(ACCESS_CONTROL_REQUEST_METHOD); if (!isValidAccessControlRequestMethod(accessControlRequestMethod)) { throw prepareCorsFailureRequest(new ForbiddenException("accessControlRequestMethod may not be empty"), requestContext); } String requestMethod = requestContext.getMethod(); if (isPreflightRequest(requestMethod, accessControlRequestMethod)) { String accessControlRequestHeaders = requestContext.getHeaderString(ACCESS_CONTROL_REQUEST_HEADERS); WebApplicationException corsPreflightFailure = validateCorsPreflightRequest(origin, accessControlRequestMethod, accessControlRequestHeaders); if (corsPreflightFailure != null) { throw prepareCorsFailureRequest(corsPreflightFailure, requestContext); } else { requestContext.abortWith( buildPreflightResponse(origin, accessControlRequestMethod, accessControlRequestHeaders)); } } else { WebApplicationException corsActualRequestFailure = validateCorsActualRequest(origin, requestMethod); if (corsActualRequestFailure != null) { throw prepareCorsFailureRequest(corsActualRequestFailure, requestContext); } } } }
CorsFilter implements ContainerRequestFilter, ContainerResponseFilter { @Override public void filter(ContainerRequestContext requestContext) throws IOException { String origin = requestContext.getHeaderString(ORIGIN); if (origin == null) { return; } URI originUri = toUriSafe(origin); if (!isValidOrigin(originUri)) { throw prepareCorsFailureRequest(new ForbiddenException("invalid origin"), requestContext); } if (sameOriginPolicy.isSameOrigin(requestContext, origin)) { return; } String accessControlRequestMethod = requestContext.getHeaderString(ACCESS_CONTROL_REQUEST_METHOD); if (!isValidAccessControlRequestMethod(accessControlRequestMethod)) { throw prepareCorsFailureRequest(new ForbiddenException("accessControlRequestMethod may not be empty"), requestContext); } String requestMethod = requestContext.getMethod(); if (isPreflightRequest(requestMethod, accessControlRequestMethod)) { String accessControlRequestHeaders = requestContext.getHeaderString(ACCESS_CONTROL_REQUEST_HEADERS); WebApplicationException corsPreflightFailure = validateCorsPreflightRequest(origin, accessControlRequestMethod, accessControlRequestHeaders); if (corsPreflightFailure != null) { throw prepareCorsFailureRequest(corsPreflightFailure, requestContext); } else { requestContext.abortWith( buildPreflightResponse(origin, accessControlRequestMethod, accessControlRequestHeaders)); } } else { WebApplicationException corsActualRequestFailure = validateCorsActualRequest(origin, requestMethod); if (corsActualRequestFailure != null) { throw prepareCorsFailureRequest(corsActualRequestFailure, requestContext); } } } private  CorsFilter(Set<String> allowedOrigins, Set<String> allowedMethods,
			boolean allowCredentials, Set<String> exposedHeaders, Set<String> allowedHeaders,
			long maxAge, SameOriginPolicy sameOriginPolicy); }
CorsFilter implements ContainerRequestFilter, ContainerResponseFilter { @Override public void filter(ContainerRequestContext requestContext) throws IOException { String origin = requestContext.getHeaderString(ORIGIN); if (origin == null) { return; } URI originUri = toUriSafe(origin); if (!isValidOrigin(originUri)) { throw prepareCorsFailureRequest(new ForbiddenException("invalid origin"), requestContext); } if (sameOriginPolicy.isSameOrigin(requestContext, origin)) { return; } String accessControlRequestMethod = requestContext.getHeaderString(ACCESS_CONTROL_REQUEST_METHOD); if (!isValidAccessControlRequestMethod(accessControlRequestMethod)) { throw prepareCorsFailureRequest(new ForbiddenException("accessControlRequestMethod may not be empty"), requestContext); } String requestMethod = requestContext.getMethod(); if (isPreflightRequest(requestMethod, accessControlRequestMethod)) { String accessControlRequestHeaders = requestContext.getHeaderString(ACCESS_CONTROL_REQUEST_HEADERS); WebApplicationException corsPreflightFailure = validateCorsPreflightRequest(origin, accessControlRequestMethod, accessControlRequestHeaders); if (corsPreflightFailure != null) { throw prepareCorsFailureRequest(corsPreflightFailure, requestContext); } else { requestContext.abortWith( buildPreflightResponse(origin, accessControlRequestMethod, accessControlRequestHeaders)); } } else { WebApplicationException corsActualRequestFailure = validateCorsActualRequest(origin, requestMethod); if (corsActualRequestFailure != null) { throw prepareCorsFailureRequest(corsActualRequestFailure, requestContext); } } } private  CorsFilter(Set<String> allowedOrigins, Set<String> allowedMethods,
			boolean allowCredentials, Set<String> exposedHeaders, Set<String> allowedHeaders,
			long maxAge, SameOriginPolicy sameOriginPolicy); @Override void filter(ContainerRequestContext requestContext); @Override void filter(ContainerRequestContext requestContext, ContainerResponseContext responseContext); }
CorsFilter implements ContainerRequestFilter, ContainerResponseFilter { @Override public void filter(ContainerRequestContext requestContext) throws IOException { String origin = requestContext.getHeaderString(ORIGIN); if (origin == null) { return; } URI originUri = toUriSafe(origin); if (!isValidOrigin(originUri)) { throw prepareCorsFailureRequest(new ForbiddenException("invalid origin"), requestContext); } if (sameOriginPolicy.isSameOrigin(requestContext, origin)) { return; } String accessControlRequestMethod = requestContext.getHeaderString(ACCESS_CONTROL_REQUEST_METHOD); if (!isValidAccessControlRequestMethod(accessControlRequestMethod)) { throw prepareCorsFailureRequest(new ForbiddenException("accessControlRequestMethod may not be empty"), requestContext); } String requestMethod = requestContext.getMethod(); if (isPreflightRequest(requestMethod, accessControlRequestMethod)) { String accessControlRequestHeaders = requestContext.getHeaderString(ACCESS_CONTROL_REQUEST_HEADERS); WebApplicationException corsPreflightFailure = validateCorsPreflightRequest(origin, accessControlRequestMethod, accessControlRequestHeaders); if (corsPreflightFailure != null) { throw prepareCorsFailureRequest(corsPreflightFailure, requestContext); } else { requestContext.abortWith( buildPreflightResponse(origin, accessControlRequestMethod, accessControlRequestHeaders)); } } else { WebApplicationException corsActualRequestFailure = validateCorsActualRequest(origin, requestMethod); if (corsActualRequestFailure != null) { throw prepareCorsFailureRequest(corsActualRequestFailure, requestContext); } } } private  CorsFilter(Set<String> allowedOrigins, Set<String> allowedMethods,
			boolean allowCredentials, Set<String> exposedHeaders, Set<String> allowedHeaders,
			long maxAge, SameOriginPolicy sameOriginPolicy); @Override void filter(ContainerRequestContext requestContext); @Override void filter(ContainerRequestContext requestContext, ContainerResponseContext responseContext);  }