public void handleActualRequest ( final HttpServletRequest request , final HttpServletResponse response ) throws InvalidCORSRequestException , CORSOriginDeniedException , UnsupportedHTTPMethodException { if ( CORSRequestType . detect ( request ) != CORSRequestType . ACTUAL ) throw new InvalidCORSRequestException ( "Invalid simple/actual CORS request" ) ; // Check origin against allow list Origin requestOrigin = new Origin ( request . getHeader ( "Origin" ) ) ; if ( ! config . isAllowedOrigin ( requestOrigin ) ) throw new CORSOriginDeniedException ( "CORS origin denied" , requestOrigin ) ; // Check method HTTPMethod method = null ; try { method = HTTPMethod . valueOf ( request . getMethod ( ) ) ; } catch ( Exception e ) { // Parse exception throw new UnsupportedHTTPMethodException ( "Unsupported HTTP method: " + request . getMethod ( ) ) ; } if ( ! config . isSupportedMethod ( method ) ) throw new UnsupportedHTTPMethodException ( "Unsupported HTTP method" , method ) ; // Success, append response headers response . addHeader ( "Access-Control-Allow-Origin" , requestOrigin . toString ( ) ) ; if ( config . supportsCredentials ) response . addHeader ( "Access-Control-Allow-Credentials" , "true" ) ; if ( ! exposedHeaders . isEmpty ( ) ) response . addHeader ( "Access-Control-Expose-Headers" , exposedHeaders ) ; // Tag request request . setAttribute ( "cors.origin" , requestOrigin . toString ( ) ) ; request . setAttribute ( "cors.requestType" , "actual" ) ; }
Handles a simple or actual CORS request .