Package org.apache.tapestry5.http.services

## Interface CorsHandlerHelper

- All Known Implementing Classes:
    `CorsHandlerHelperImpl`

      public interface CorsHandlerHelper

  Service that provides useful methods for `CorsHandler` implementations.
  Since:
    5.8.2
  See Also:
    `CorsHandler`

- - ### Field Summary

    Fields
    Modifier and Type | Field | Description
    --- | --- | ---
    `static String` | `ALLOW_CREDENTIALS_HEADER` | Name of the Access-Control-Allow-Credentials HTTP header.
    `static String` | `ALLOW_HEADERS_HEADER` | Name of the Access-Control-Allow-Headers HTTP header.
    `static String` | `ALLOW_METHODS_HEADER` | Name of the Access-Control-Allow-Methods HTTP header.
    `static String` | `ALLOW_ORIGIN_HEADER` | Name of the Access-Control-Allow-Origin HTTP header.
    `static String` | `EXPOSE_HEADERS_HEADER` | Name of the Access-Control-Expose-Headers HTTP header.
    `static String` | `MAX_AGE_HEADER` | Name of the Access-Control-Max-Age HTTP header.
    `static String` | `OPTIONS_METHOD` | OPTIONS HTTP method name.
    `static String` | `ORIGIN_HEADER` | Name of the Origin HTTP header.
    `static String` | `ORIGIN_WILDCARD` | The CORS Origin wildcard.
    `static String` | `REQUEST_HEADERS_HEADER` | Name of the Access-Control-Request-Headers HTTP header.
    `static String` | `VARY_HEADER` | Name of the Vary HTTP header.

  - ### Method Summary

    All Methods Instance Methods Abstract Methods Default Methods
    Modifier and Type | Method | Description
    --- | --- | ---
    `default void` | `addValueToVaryHeader​(HttpServletResponse response, String value)` | Adds a value to the Vary HTTP header.
    `void` | `configureAllowedHeaders​(HttpServletResponse response, HttpServletRequest request)` | Conditionally the Access-Control-Request-Headers HTTP header.
    `void` | `configureCredentials​(HttpServletResponse response)` | Conditionally sets the Access-Control-Allow-Credentials HTTP header.
    `void` | `configureExposeHeaders​(HttpServletResponse response)` | Conditionally sets the Access-Control-Expose-Headers HTTP header.
    `void` | `configureMaxAge​(HttpServletResponse response)` | Conditionally sets the Access-Control-Max-Age HTTP header.
    `void` | `configureMethods​(HttpServletResponse response)` | Conditionally sets the Access-Control-Allow-Methods HTTP header in responses to preflight CORS requests.
    `void` | `configureOrigin​(HttpServletResponse response, String value)` | Sets the Access-Control-Allow-Origin HTTP header with a given value.
    `Optional<String>` | `getAllowedOrigin​(HttpServletRequest request)` | Returns the origin of this requests, if it's allowed.
    `Optional<String>` | `getOrigin​(HttpServletRequest request)` | Returns the value of the Origin HTTP header.
    `String` | `getPath​(HttpServletRequest request)` | Returns the requested URL path, using the same logic as `Request.getPath()`.
    `boolean` | `isPreflight​(HttpServletRequest request)` | Tells whether this request is a CORS preflight one (i.e.

- - ### Field Detail

    - #### ORIGIN_HEADER

          static final String ORIGIN_HEADER

      Name of the Origin HTTP header.
      See Also:
        Constant Field Values

    - #### ALLOW_ORIGIN_HEADER

          static final String ALLOW_ORIGIN_HEADER

      Name of the Access-Control-Allow-Origin HTTP header.
      See Also:
        Constant Field Values

    - #### ALLOW_CREDENTIALS_HEADER

          static final String ALLOW_CREDENTIALS_HEADER

      Name of the Access-Control-Allow-Credentials HTTP header.
      See Also:
        Constant Field Values

    - #### ALLOW_METHODS_HEADER

          static final String ALLOW_METHODS_HEADER

      Name of the Access-Control-Allow-Methods HTTP header.
      See Also:
        Constant Field Values

    - #### REQUEST_HEADERS_HEADER

          static final String REQUEST_HEADERS_HEADER

      Name of the Access-Control-Request-Headers HTTP header.
      See Also:
        Constant Field Values

    - #### ALLOW_HEADERS_HEADER

          static final String ALLOW_HEADERS_HEADER

      Name of the Access-Control-Allow-Headers HTTP header.
      See Also:
        Constant Field Values

    - #### EXPOSE_HEADERS_HEADER

          static final String EXPOSE_HEADERS_HEADER

      Name of the Access-Control-Expose-Headers HTTP header.
      See Also:
        Constant Field Values

    - #### MAX_AGE_HEADER

          static final String MAX_AGE_HEADER

      Name of the Access-Control-Max-Age HTTP header.
      See Also:
        Constant Field Values

    - #### VARY_HEADER

          static final String VARY_HEADER

      Name of the Vary HTTP header.
      See Also:
        Constant Field Values

    - #### OPTIONS_METHOD

          static final String OPTIONS_METHOD

      OPTIONS HTTP method name.
      See Also:
        Constant Field Values

    - #### ORIGIN_WILDCARD

          static final String ORIGIN_WILDCARD

      The CORS Origin wildcard.
      See Also:
        Constant Field Values

  - ### Method Detail

    - #### getPath

          String getPath​(HttpServletRequest request)

      Returns the requested URL path, using the same logic as `Request.getPath()`.
      Parameters:
        `request` - an `HttpServletRequest`.
      Returns:
        a `String` with the path.

    - #### getOrigin

          Optional<String> getOrigin​(HttpServletRequest request)

      Returns the value of the Origin HTTP header.
      Parameters:
        `request` - an `HttpServletRequest`.
      Returns:
        an `Optional` wrapping the Origin HTTP header value.

    - #### isPreflight

          boolean isPreflight​(HttpServletRequest request)

      Tells whether this request is a CORS preflight one (i.e. HTTP method OPTION and non-empty Origin HTTP header).
      Parameters:
        `request` - an `HttpServletRequest`.
      Returns:
        `true` if it's a preflight request, `false` otherwise.

    - #### getAllowedOrigin

          Optional<String> getAllowedOrigin​(HttpServletRequest request)

      Returns the origin of this requests, if it's allowed.
      Parameters:
        `request` - an `HttpServletRequest`.
      Returns:
        an `Optional` wrapping the allowed origin.
      See Also:
        `TapestryHttpSymbolConstants.CORS_ALLOWED_ORIGINS`

    - #### configureOrigin

          void configureOrigin​(HttpServletResponse response,
                               String value)

      Sets the Access-Control-Allow-Origin HTTP header with a given value.
      Parameters:
        `value` - a String.
        `response` - an `HttpServletResponse` instance.
      See Also:
        `ALLOW_ORIGIN_HEADER`

    - #### configureCredentials

          void configureCredentials​(HttpServletResponse response)

      Conditionally sets the Access-Control-Allow-Credentials HTTP header. Out-of-the-box, this is done based on the `TapestryHttpSymbolConstants.CORS_ALLOW_CREDENTIALS` symbol.
      Parameters:
        `response` - an `HttpServletResponse`.
      See Also:
        `TapestryHttpSymbolConstants.CORS_ALLOW_CREDENTIALS`

    - #### configureMethods

          void configureMethods​(HttpServletResponse response)

      Conditionally sets the Access-Control-Allow-Methods HTTP header in responses to preflight CORS requests. Out-of-the-box, the value comes from `TapestryHttpSymbolConstants.CORS_ALLOW_CREDENTIALS` symbol and the header is only set if the value isn't empty.
      Parameters:
        `response` - an `HttpServletResponse`.
      See Also:
        `TapestryHttpSymbolConstants.CORS_ALLOW_CREDENTIALS`

    - #### configureAllowedHeaders

          void configureAllowedHeaders​(HttpServletResponse response,
                                       HttpServletRequest request)

      Conditionally the Access-Control-Request-Headers HTTP header. Out-of-the-box, the value comes from `TapestryHttpSymbolConstants.CORS_ALLOWED_HEADERS` symbol if not empty. Otherwise, it comes from the value of the same HTTP header from the request, also if not empty. Otherwise, the header isn't set.
      Parameters:
        `response` - an `HttpServletResponse`.
        `request` - an `HttpServletRequest`.
      See Also:
        `TapestryHttpSymbolConstants.CORS_ALLOWED_HEADERS`

    - #### configureExposeHeaders

          void configureExposeHeaders​(HttpServletResponse response)

      Conditionally sets the Access-Control-Expose-Headers HTTP header. Out-of-the-box, the value comes from `TapestryHttpSymbolConstants.CORS_EXPOSE_HEADERS` symbol, if not empty. Otherwise, the header isn't set.
      Parameters:
        `response` - an `HttpServletResponse`.
      See Also:
        `TapestryHttpSymbolConstants.CORS_EXPOSE_HEADERS`

    - #### configureMaxAge

          void configureMaxAge​(HttpServletResponse response)

      Conditionally sets the Access-Control-Max-Age HTTP header. Out-of-the-box, the value comes from `TapestryHttpSymbolConstants.CORS_MAX_AGE` symbol, if not empty. Otherwise, the header isn't set.
      Parameters:
        `response` - an `HttpServletResponse`.
      See Also:
        `TapestryHttpSymbolConstants.CORS_MAX_AGE`

    - #### addValueToVaryHeader

          default void addValueToVaryHeader​(HttpServletResponse response,
                                            String value)

      Adds a value to the Vary HTTP header.
      Parameters:
        `response` - an `HttpServletResponse` instance.
        `value` - the value to be added.