src/com/thetransactioncompany/cors/CORSFilter.java
private void doFilter(final HttpServletRequest request, final HttpServletResponse response, final FilterChain chain)
		throws IOException, ServletException {
	
		// Tag
		handler.tagRequest(request);
		
		CORSRequestType type = CORSRequestType.detect(request);
	
		try {
			if (type == CORSRequestType.ACTUAL) {
				// Simple/actual CORS request
				handler.handleActualRequest(request, response);
				chain.doFilter(request, response);
			}
			else if (type == CORSRequestType.PREFLIGHT) {
				// Preflight CORS request, handle but don't pass
				// further down the chain
				handler.handlePreflightRequest(request, response);
			}
			else if (config.allowGenericHttpRequests) {
				// Not a CORS request, but allow it through
				request.setAttribute("cors.isCorsRequest", false); // tag
				chain.doFilter(request, response);
			}
			else {
				// Generic HTTP requests denied
				request.setAttribute("cors.isCorsRequest", false); // tag
				printMessage(response, HttpServletResponse.SC_FORBIDDEN, "Generic HTTP requests not allowed");
			}
				
		} catch (InvalidCORSRequestException e) {
			
			request.setAttribute("cors.isCorsRequest", false); // tag
			printMessage(response, HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
		
		} catch (CORSOriginDeniedException e) {
			
			String msg = e.getMessage() + ": " + e.getRequestOrigin();
			printMessage(response, HttpServletResponse.SC_FORBIDDEN, msg);
			
		} catch (UnsupportedHTTPMethodException e) {
		
			String msg = e.getMessage();
			
			HTTPMethod method = e.getRequestedMethod();
			
			if (method != null)
				msg = msg + ": " + method.toString();
		
			printMessage(response, HttpServletResponse.SC_METHOD_NOT_ALLOWED, msg);
			
		} catch (UnsupportedHTTPHeaderException e) {
		
			String msg = e.getMessage();
			
			HeaderFieldName header = e.getRequestHeader();
			
			if (header != null)
				msg = msg + ": " + header.toString();
		
			printMessage(response, HttpServletResponse.SC_FORBIDDEN, msg);
		}
	}
private void doFilter(final HttpServletRequest request, final HttpServletResponse response, final FilterChain chain)
		throws IOException, ServletException {
	
		// Tag
		handler.tagRequest(request);
		
		CORSRequestType type = CORSRequestType.detect(request);
	
		try {
			if (type == CORSRequestType.ACTUAL) {
				// Simple/actual CORS request
				handler.handleActualRequest(request, response);
				chain.doFilter(request, response);
			}
			else if (type == CORSRequestType.PREFLIGHT) {
				// Preflight CORS request, handle but don't pass
				// further down the chain
				handler.handlePreflightRequest(request, response);
			}
			else if (config.allowGenericHttpRequests) {
				// Not a CORS request, but allow it through
				request.setAttribute("cors.isCorsRequest", false); // tag
				chain.doFilter(request, response);
			}
			else {
				// Generic HTTP requests denied
				request.setAttribute("cors.isCorsRequest", false); // tag
				printMessage(response, HttpServletResponse.SC_FORBIDDEN, "Generic HTTP requests not allowed");
			}
				
		} catch (InvalidCORSRequestException e) {
			
			request.setAttribute("cors.isCorsRequest", false); // tag
			printMessage(response, HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
		
		} catch (CORSOriginDeniedException e) {
			
			String msg = e.getMessage() + ": " + e.getRequestOrigin();
			printMessage(response, HttpServletResponse.SC_FORBIDDEN, msg);
			
		} catch (UnsupportedHTTPMethodException e) {
		
			String msg = e.getMessage();
			
			HTTPMethod method = e.getRequestedMethod();
			
			if (method != null)
				msg = msg + ": " + method.toString();
		
			printMessage(response, HttpServletResponse.SC_METHOD_NOT_ALLOWED, msg);
			
		} catch (UnsupportedHTTPHeaderException e) {
		
			String msg = e.getMessage();
			
			HeaderFieldName header = e.getRequestHeader();
			
			if (header != null)
				msg = msg + ": " + header.toString();
		
			printMessage(response, HttpServletResponse.SC_FORBIDDEN, msg);
		}
	}
Filters an HTTP request/reponse pair according to the configured CORS
policy. Also tags the request with CORS information to downstream
handlers.

@param request  The servlet request.
@param response The servlet response.
@param chain    The filter chain.

@throws IOException      On a I/O exception.
@throws ServletException On a general request processing exception.