private String checkOriginHeader ( HttpServletRequest request , JCorsConfig config ) { String originHeader = request . getHeader ( CorsHeaders . ORIGIN_HEADER ) ; Constraint . ensureNotEmpty ( originHeader , "Cross-Origin requests must specify an Origin Header" ) ; String [ ] origins = originHeader . split ( " " ) ; for ( String origin : origins ) { Constraint . ensureTrue ( config . isOriginAllowed ( origin ) , String . format ( "The specified origin is not allowed: '%s'" , origin ) ) ; } return originHeader ; }
Checks if the origin is allowed