public static void filterResponse ( ContainerRequestContext requestContext , ContainerResponseContext responseContext , String extraAccesControlAllowHeaders ) { String requestOrigin = requestContext . getHeaderString ( Headers . ORIGIN ) ; if ( requestOrigin == null ) { return ; } // CORS validation already checked on request filter, see AbstractCorsRequestFilter MultivaluedMap < String , Object > responseHeaders = responseContext . getHeaders ( ) ; responseHeaders . add ( Headers . ACCESS_CONTROL_ALLOW_ORIGIN , requestOrigin ) ; responseHeaders . add ( Headers . ACCESS_CONTROL_ALLOW_CREDENTIALS , "true" ) ; responseHeaders . add ( Headers . ACCESS_CONTROL_ALLOW_METHODS , Headers . DEFAULT_CORS_ACCESS_CONTROL_ALLOW_METHODS ) ; responseHeaders . add ( Headers . ACCESS_CONTROL_MAX_AGE , 72 * 60 * 60 ) ; if ( extraAccesControlAllowHeaders != null ) { responseHeaders . add ( Headers . ACCESS_CONTROL_ALLOW_HEADERS , Headers . DEFAULT_CORS_ACCESS_CONTROL_ALLOW_HEADERS + "," + extraAccesControlAllowHeaders . trim ( ) ) ; } else { responseHeaders . add ( Headers . ACCESS_CONTROL_ALLOW_HEADERS , Headers . DEFAULT_CORS_ACCESS_CONTROL_ALLOW_HEADERS ) ; } }
Apply CORS headers on response