String op = (String)m.getExchange().get(CrossOriginResourceSharingFilter.class.getName());
if (op == null || op == PREFLIGHT_FAILED) {
return response;
}
ResponseBuilder rbuilder = Response.fromResponse(response);
/* Common to simple and preflight */
rbuilder.header(CorsHeaderConstants.HEADER_AC_ALLOW_ORIGIN,
m.getExchange().get(CorsHeaderConstants.HEADER_ORIGIN));
rbuilder.header(CorsHeaderConstants.HEADER_AC_ALLOW_CREDENTIALS,
m.getExchange().get(CorsHeaderConstants.HEADER_AC_ALLOW_CREDENTIALS));
if (SIMPLE_REQUEST.equals(op)) {
/* 5.1.4 expose headers */
List<String> effectiveExposeHeaders
= getHeadersFromInput(m, CorsHeaderConstants.HEADER_AC_EXPOSE_HEADERS);
if (effectiveExposeHeaders != null) {
addHeaders(rbuilder, CorsHeaderConstants.HEADER_AC_EXPOSE_HEADERS,
effectiveExposeHeaders, false);
}
// if someone wants to clear the cache, we can't help them.
return rbuilder.build();
} else {
// 5.2.8 max-age
String maValue = (String)m.getExchange().get(CorsHeaderConstants.HEADER_AC_MAX_AGE);
if (maValue != null) {
rbuilder.header(CorsHeaderConstants.HEADER_AC_MAX_AGE, maValue);
}
// 5.2.9 add allowed methods
/*
* Currently, input side just lists the one requested method, and spec endorses that.
*/
addHeaders(rbuilder, CorsHeaderConstants.HEADER_AC_ALLOW_METHODS,
getHeadersFromInput(m, CorsHeaderConstants.HEADER_AC_ALLOW_METHODS), false);
// 5.2.10 add allowed headers
List<String> rqAllowedHeaders = getHeadersFromInput(m,
CorsHeaderConstants.HEADER_AC_ALLOW_HEADERS);
if (rqAllowedHeaders != null) {
addHeaders(rbuilder, CorsHeaderConstants.HEADER_AC_ALLOW_HEADERS, rqAllowedHeaders, false);
}
return rbuilder.build();
}
}