public static String matchOrigin ( HttpServerExchange exchange , Collection < String > allowedOrigins ) throws Exception { HeaderMap headers = exchange . getRequestHeaders ( ) ; String [ ] origins = headers . get ( Headers . ORIGIN ) . toArray ( ) ; if ( allowedOrigins != null && ! allowedOrigins . isEmpty ( ) ) { for ( String allowedOrigin : allowedOrigins ) { for ( String origin : origins ) { if ( allowedOrigin . equalsIgnoreCase ( sanitizeDefaultPort ( origin ) ) ) { return allowedOrigin ; } } } } String allowedOrigin = defaultOrigin ( exchange ) ; for ( String origin : origins ) { if ( allowedOrigin . equalsIgnoreCase ( sanitizeDefaultPort ( origin ) ) ) { return allowedOrigin ; } } ROOT_LOGGER . debug ( "Request rejected due to HOST/ORIGIN mis-match." ) ; ResponseCodeHandler . HANDLE_403 . handleRequest ( exchange ) ; return null ; }
Match the Origin header with the allowed origins . If it doesn t match then a 403 response code is set on the response and it returns null .