public Result call ( Route route , RequestContext context ) throws Exception { // Is CORS required? String originHeader = context . request ( ) . getHeader ( ORIGIN ) ; if ( originHeader != null ) { originHeader = originHeader . toLowerCase ( ) ; } // If not Preflight if ( route . getHttpMethod ( ) != HttpMethod . OPTIONS ) { return retrieveAndReturnResult ( context , originHeader ) ; } // OPTIONS route exists, don't use filter! (might manually implement // CORS?) if ( ! route . isUnbound ( ) ) { return context . proceed ( ) ; } // Try "Preflight" // Find existing methods for other routes Collection < Route > routes = router . getRoutes ( ) ; List < String > methods = new ArrayList <> ( 4 ) ; // expect POST PUT GET DELETE for ( Route r : routes ) { if ( r . matches ( r . getHttpMethod ( ) , route . getUrl ( ) ) ) { methods . add ( r . getHttpMethod ( ) . name ( ) ) ; } } // If there's none, proceed to 404 if ( methods . isEmpty ( ) ) { return context . proceed ( ) ; } String requestMethod = context . request ( ) . getHeader ( ACCESS_CONTROL_REQUEST_METHOD ) ; // If it's not a CORS request, just proceed! if ( originHeader == null || requestMethod == null ) { return context . proceed ( ) ; } Result res = Results . ok ( ) ; // setup result if ( ! methods . contains ( requestMethod . toUpperCase ( ) ) ) { res = Results . unauthorized ( "No such method for this route" ) ; } Integer maxAge = getMaxAge ( ) ; if ( maxAge != null ) { res = res . with ( ACCESS_CONTROL_MAX_AGE , String . valueOf ( maxAge ) ) ; } // Otherwise we should be return OK with the appropriate headers. String exposedHeaders = getExposedHeadersHeader ( ) ; String allowedHosts = getAllowedHostsHeader ( originHeader ) ; String allowedMethods = Joiner . on ( ", " ) . join ( methods ) ; Result result = res . with ( ACCESS_CONTROL_ALLOW_ORIGIN , allowedHosts ) . with ( ACCESS_CONTROL_ALLOW_METHODS , allowedMethods ) . with ( ACCESS_CONTROL_ALLOW_HEADERS , exposedHeaders ) ; if ( getAllowCredentials ( ) ) { result = result . with ( ACCESS_CONTROL_ALLOW_CREDENTIALS , "true" ) ; } return result ; }
Interception method . It checks whether or not the request requires CORS support or not . It also checks whether the requests is allowed or not .