private boolean isValidCORSRequest(final HttpServletRequest req){
  final String hostHeader=req.getHeader(CORSConstants.HOST);
  final String originHeader=req.getHeader(CORSConstants.ORIGIN);
  if (originHeader == null || originHeader.isEmpty()) {
    DEBUG.warning("CORS Fail - Request did not contain an origin header.");
    return false;
  }
  if (!acceptedOrigins.contains(CORSConstants.ALL)) {
    if (!acceptedOrigins.contains(originHeader)) {
      DEBUG.warning("CORS Fail - Requested origin comes from a location not whitelisted.");
      return false;
    }
  }
  if (expectedHostname != null && !expectedHostname.isEmpty() && !expectedHostname.equals(hostHeader)) {
    DEBUG.warning("CORS Fail - Expected hostname does not equal actual hostname.");
    return false;
  }
  if (!acceptedMethods.contains(req.getMethod())) {
    DEBUG.warning("CORS Fail - Requested HTTP method has not been whitelisted.");
    return false;
  }
  return true;
}

private boolean isValidCORSRequest ( final HttpServletRequest req ) { final String hostHeader = req . getHeader ( CORSConstants . HOST ) ; final String originHeader = req . getHeader ( CORSConstants . ORIGIN ) ; if ( originHeader == null || originHeader . isEmpty ( ) ) { DEBUG . warning ( "CORS Fail - Request did not contain an origin header." ) ; return false ; } if ( ! acceptedOrigins . contains ( CORSConstants . ALL ) ) { if ( ! acceptedOrigins . contains ( originHeader ) ) { DEBUG . warning ( "CORS Fail - Requested origin comes from a location not whitelisted." ) ; return false ; } } if ( expectedHostname != null && ! expectedHostname . isEmpty ( ) && ! expectedHostname . equals ( hostHeader ) ) { DEBUG . warning ( "CORS Fail - Expected hostname does not equal actual hostname." ) ; return false ; } if ( ! acceptedMethods . contains ( req . getMethod ( ) ) ) { DEBUG . warning ( "CORS Fail - Requested HTTP method has not been whitelisted." ) ; return false ; } return true ; }
detrermines if the request contains a whitelisted origin , is a method type which this instantiation of the corsservice supports , and - if supplied with a hostname at configtime - whether or not the hostname in the request matches the expected hostname .
