public void preflightRequest(final String origin, final String expectedOrigin, final String corsHeaders) {
final FullHttpRequest httpRequest = createHttpRequest(HttpMethod.OPTIONS);
httpRequest.headers().set(HttpHeaders.Names.ORIGIN, origin);
httpRequest.headers().set(HttpHeaders.Names.ACCESS_CONTROL_REQUEST_HEADERS, corsHeaders);
final EmbeddedChannel channel = new EmbeddedChannel(new CorsInboundHandler());
channel.writeInbound(httpRequest);
final HttpResponse response = channel.readOutbound();
final HttpHeaders headers = response.headers();
assertThat(headers.get(HttpHeaders.Names.CONTENT_TYPE), is("text/plain; charset=UTF-8"));
assertThat(headers.get(HttpHeaders.Names.CACHE_CONTROL), is("max-age=31536000, public"));
assertThat(headers.get(HttpHeaders.Names.ACCESS_CONTROL_ALLOW_ORIGIN), is(expectedOrigin));
assertThat(headers.get(HttpHeaders.Names.ACCESS_CONTROL_ALLOW_CREDENTIALS), is("true"));
assertThat(headers.get(HttpHeaders.Names.ACCESS_CONTROL_MAX_AGE), is("31536000"));
assertThat(headers.get(HttpHeaders.Names.ACCESS_CONTROL_ALLOW_METHODS), is("OPTIONS, GET"));
assertThat(headers.get(HttpHeaders.Names.ACCESS_CONTROL_ALLOW_HEADERS), is("Content-Type"));
assertThat(headers.get(HttpHeaders.Names.ACCESS_CONTROL_ALLOW_CREDENTIALS), is("true"));
assertThat(headers.get(HttpHeaders.Names.EXPIRES), is("dummy"));
assertThat(headers.get(HttpHeaders.Names.SET_COOKIE), is("JSESSIONID=dummy;path=/"));
channel.finish();
}