qbit/core/src/main/java/io/advantageous/qbit/http/server/CorsResponseDecorator.java
protected boolean handleSimpleCORS(final HttpRequestHolder request,
                                       final HttpResponseHolder response) {

        CorsResponseDecorator.CORSRequestType requestType = checkRequestType(request);
        if (!(requestType == CorsResponseDecorator.CORSRequestType.SIMPLE ||
                requestType == CorsResponseDecorator.CORSRequestType.ACTUAL)) {
            throw new IllegalArgumentException(CorsSupport.CORS_WRONG_TYPE_2);//TODO: String replacement
        }

        final String origin = request.getHeaders().get(CorsResponseDecorator.REQUEST_HEADER_ORIGIN);
        final RequestMethod method = RequestMethod.valueOf(request.getMethod());

        // Section 6.1.2
        if (!isOriginAllowed(origin)) {
            handleInvalidCORS(request, response);
            return false;
        }

        if (!corsSupport.getAllowedMethods().contains(method)) {
            handleInvalidCORS(request, response);
            return false;
        }

        // Section 6.1.3
        // Add a single Access-Control-Allow-Origin header.
        if (anyOriginAllowed && !corsSupport.isAllowCredentials()) {
            // If resource doesn't support credentials and if any origin is
            // allowed
            // to make CORS request, return header with '*'.
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                    "*");
        } else {
            // If the resource supports credentials add a single
            // Access-Control-Allow-Origin header, with the value of the Origin
            // header as value.
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                    origin);
        }

        // Section 6.1.3
        // If the resource supports credentials, add a single
        // Access-Control-Allow-Credentials header with the case-sensitive
        // string "true" as value.
        if (corsSupport.isAllowCredentials()) {
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS,
                    "true");
        }

        // Section 6.1.4
        // If the list of exposed headers is not empty add one or more
        // Access-Control-Expose-headers headers, with as values the header
        // field names given in the list of exposed headers.
        if ((corsSupport.getExposedHeaders() != null) && (corsSupport.getExposedHeaders().size() > 0)) {
            String exposedHeadersString = join(corsSupport.getExposedHeaders(), ",");
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS,
                    exposedHeadersString);
        }

        return true;
    }
protected boolean handleSimpleCORS(final HttpRequestHolder request,
                                       final HttpResponseHolder response) {

        CorsResponseDecorator.CORSRequestType requestType = checkRequestType(request);
        if (!(requestType == CorsResponseDecorator.CORSRequestType.SIMPLE ||
                requestType == CorsResponseDecorator.CORSRequestType.ACTUAL)) {
            throw new IllegalArgumentException(CorsSupport.CORS_WRONG_TYPE_2);//TODO: String replacement
        }

        final String origin = request.getHeaders().get(CorsResponseDecorator.REQUEST_HEADER_ORIGIN);
        final RequestMethod method = RequestMethod.valueOf(request.getMethod());

        // Section 6.1.2
        if (!isOriginAllowed(origin)) {
            handleInvalidCORS(request, response);
            return false;
        }

        if (!corsSupport.getAllowedMethods().contains(method)) {
            handleInvalidCORS(request, response);
            return false;
        }

        // Section 6.1.3
        // Add a single Access-Control-Allow-Origin header.
        if (anyOriginAllowed && !corsSupport.isAllowCredentials()) {
            // If resource doesn't support credentials and if any origin is
            // allowed
            // to make CORS request, return header with '*'.
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                    "*");
        } else {
            // If the resource supports credentials add a single
            // Access-Control-Allow-Origin header, with the value of the Origin
            // header as value.
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                    origin);
        }

        // Section 6.1.3
        // If the resource supports credentials, add a single
        // Access-Control-Allow-Credentials header with the case-sensitive
        // string "true" as value.
        if (corsSupport.isAllowCredentials()) {
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS,
                    "true");
        }

        // Section 6.1.4
        // If the list of exposed headers is not empty add one or more
        // Access-Control-Expose-headers headers, with as values the header
        // field names given in the list of exposed headers.
        if ((corsSupport.getExposedHeaders() != null) && (corsSupport.getExposedHeaders().size() > 0)) {
            String exposedHeadersString = join(corsSupport.getExposedHeaders(), ",");
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS,
                    exposedHeadersString);
        }

        return true;
    }
Handles a CORS request of type {@link CORSRequestType}.SIMPLE.

@param request  request
@param response response
@return is there a CORS simple handler for this request or response.