public String extractCorsOrigin ( String pOrigin ) { if ( pOrigin != null ) { // Prevent HTTP response splitting attacks String origin = pOrigin . replaceAll ( "[\\n\\r]*" , "" ) ; if ( backendManager . isOriginAllowed ( origin , false ) ) { return "null" . equals ( origin ) ? "*" : origin ; } else { return null ; } } return null ; }
Check whether for the given host is a cross - browser request allowed . This check is delegated to the backendmanager which is responsible for the security configuration . Also some sanity checks are applied .