public void handlePreflightRequest ( final HttpServletRequest request , final HttpServletResponse response ) throws InvalidCORSRequestException , CORSOriginDeniedException , UnsupportedHTTPMethodException , UnsupportedHTTPHeaderException { if ( CORSRequestType . detect ( request ) != CORSRequestType . PREFLIGHT ) throw new InvalidCORSRequestException ( "Invalid preflight CORS request" ) ; // Check origin against allow list Origin requestOrigin = new Origin ( request . getHeader ( "Origin" ) ) ; if ( ! config . isAllowedOrigin ( requestOrigin ) ) throw new CORSOriginDeniedException ( "CORS origin denied" , requestOrigin ) ; // Parse requested method // Note: method checking must be done after header parsing, see CORS spec String requestMethodHeader = request . getHeader ( "Access-Control-Request-Method" ) ; if ( requestMethodHeader == null ) throw new InvalidCORSRequestException ( "Invalid preflight CORS request: Missing Access-Control-Request-Method header" ) ; HTTPMethod requestedMethod = null ; try { requestedMethod = HTTPMethod . valueOf ( requestMethodHeader . toUpperCase ( ) ) ; } catch ( Exception e ) { // Parse exception throw new UnsupportedHTTPMethodException ( "Unsupported HTTP method: " + requestMethodHeader ) ; } // Parse custom headers final String [ ] requestHeaderValues = parseMultipleHeaderValues ( request . getHeader ( "Access-Control-Request-Headers" ) ) ; final HeaderFieldName [ ] requestHeaders = new HeaderFieldName [ requestHeaderValues . length ] ; for ( int i = 0 ; i < requestHeaders . length ; i ++ ) { try { requestHeaders [ i ] = new HeaderFieldName ( requestHeaderValues [ i ] ) ; } catch ( IllegalArgumentException e ) { // Invalid header name throw new InvalidCORSRequestException ( "Invalid preflight CORS request: Bad request header value" ) ; } } // Now, do method check if ( ! config . isSupportedMethod ( requestedMethod ) ) throw new UnsupportedHTTPMethodException ( "Unsupported HTTP method" , requestedMethod ) ; // Author request headers check for ( int i = 0 ; i < requestHeaders . length ; i ++ ) { if ( ! config . supportedHeaders . contains ( requestHeaders [ i ] ) ) throw new UnsupportedHTTPHeaderException ( "Unsupported HTTP request header" , requestHeaders [ i ] ) ; } // Success, append response headers if ( config . supportsCredentials ) { response . addHeader ( "Access-Control-Allow-Origin" , requestOrigin . toString ( ) ) ; response . addHeader ( "Access-Control-Allow-Credentials" , "true" ) ; } else { if ( config . allowAnyOrigin ) response . addHeader ( "Access-Control-Allow-Origin" , "*" ) ; else response . addHeader ( "Access-Control-Allow-Origin" , requestOrigin . toString ( ) ) ; } if ( config . maxAge > 0 ) response . addHeader ( "Access-Control-Max-Age" , Integer . toString ( config . maxAge ) ) ; response . addHeader ( "Access-Control-Allow-Methods" , supportedMethods ) ; if ( ! supportedHeaders . isEmpty ( ) ) response . addHeader ( "Access-Control-Allow-Headers" , supportedHeaders ) ; }
Handles a preflight CORS request .