Package org.codelibs.fess.cors

Class CorsHandler

java.lang.Object

org.codelibs.fess.cors.CorsHandler

Direct Known Subclasses:

DefaultCorsHandler

public abstract class CorsHandler
extends Object

Abstract base class for handling CORS (Cross-Origin Resource Sharing) requests. Provides common CORS header constants and defines the processing interface.

Field Summary

Fields

Modifier and Type	Field	Description
protected static final String	ACCESS_CONTROL_ALLOW_CREDENTIALS	CORS header for allowing credentials.
protected static final String	ACCESS_CONTROL_ALLOW_HEADERS	CORS header for specifying allowed headers.
protected static final String	ACCESS_CONTROL_ALLOW_METHODS	CORS header for specifying allowed HTTP methods.
protected static final String	ACCESS_CONTROL_ALLOW_ORIGIN	CORS header for specifying allowed origin.
protected static final String	ACCESS_CONTROL_ALLOW_PRIVATE_NETWORK	CORS header for allowing private network access.
protected static final String	ACCESS_CONTROL_MAX_AGE	CORS header for specifying cache duration for preflight requests.
protected static final String	ALLOW_ORIGIN_ALL	Literal value returned in Access-Control-Allow-Origin for wildcard (non-credentialed) CORS.
protected static final String	ORIGIN	HTTP Origin header name.
protected static final String	VARY	HTTP Vary response header name.

Constructor Summary

Constructors

Constructor	Description
CorsHandler()	Creates a new instance of CorsHandler.

Method Summary

Modifier and Type	Method	Description
abstract void	process(String origin, CorsMatchType matchType, jakarta.servlet.ServletRequest request, jakarta.servlet.ServletResponse response)	Processes the CORS request by setting appropriate headers.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

ACCESS_CONTROL_ALLOW_ORIGIN

protected static final String ACCESS_CONTROL_ALLOW_ORIGIN

CORS header for specifying allowed origin.

See Also:

• Constant Field Values

ACCESS_CONTROL_ALLOW_HEADERS

protected static final String ACCESS_CONTROL_ALLOW_HEADERS

CORS header for specifying allowed headers.

See Also:

• Constant Field Values

ACCESS_CONTROL_ALLOW_METHODS

protected static final String ACCESS_CONTROL_ALLOW_METHODS

CORS header for specifying allowed HTTP methods.

See Also:

• Constant Field Values

ACCESS_CONTROL_ALLOW_PRIVATE_NETWORK

protected static final String ACCESS_CONTROL_ALLOW_PRIVATE_NETWORK

CORS header for allowing private network access.

See Also:

• Constant Field Values

ACCESS_CONTROL_ALLOW_CREDENTIALS

protected static final String ACCESS_CONTROL_ALLOW_CREDENTIALS

CORS header for allowing credentials.

See Also:

• Constant Field Values

ACCESS_CONTROL_MAX_AGE

protected static final String ACCESS_CONTROL_MAX_AGE

CORS header for specifying cache duration for preflight requests.

See Also:

• Constant Field Values

ALLOW_ORIGIN_ALL

protected static final String ALLOW_ORIGIN_ALL

Literal value returned in Access-Control-Allow-Origin for wildcard (non-credentialed) CORS.

See Also:

• Constant Field Values

VARY

protected static final String VARY

HTTP Vary response header name.

See Also:

• Constant Field Values

ORIGIN

protected static final String ORIGIN

HTTP Origin header name. Appended to Vary for every origin-bearing request.

See Also:

• Constant Field Values

Constructor Details

CorsHandler

public CorsHandler()

Creates a new instance of CorsHandler.

Method Details

process

public abstract void process(String origin,
 CorsMatchType matchType,
 jakarta.servlet.ServletRequest request,
 jakarta.servlet.ServletResponse response)

Processes the CORS request by setting appropriate headers.

Parameters:

origin - the origin of the request

matchType - how the origin matched the allow list (EXACT reflects the origin and may send credentials; WILDCARD returns literal "*")

request - the servlet request

response - the servlet response