qbit/core/src/main/java/io/advantageous/qbit/http/server/CorsResponseDecorator.java
protected boolean handlePreflightCORS(final HttpRequestHolder request,
                                          final HttpResponseHolder response) {

        CORSRequestType requestType = checkRequestType(request);
        if (requestType != CORSRequestType.PRE_FLIGHT) {
            throw new IllegalArgumentException(CorsSupport.CORS_WRONG_TYPE_2);
            //TODO: String replace into above CORSRequestType.PRE_FLIGHT.name().toLowerCase(Locale.ENGLISH)));
        }

        final String origin = request.getHeaders().get(CorsResponseDecorator.REQUEST_HEADER_ORIGIN);

        // Section 6.2.2
        if (!isOriginAllowed(origin)) {
            handleInvalidCORS(request, response);
            return false;
        }

        // Section 6.2.3
        String accessControlRequestMethod = request.getHeaders().get(
                CorsResponseDecorator.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD);
        if (accessControlRequestMethod == null) {
            handleInvalidCORS(request, response);
            return false;
        } else {
            accessControlRequestMethod = accessControlRequestMethod.trim();
        }

        // Section 6.2.4
        String accessControlRequestHeadersHeader = request.getHeaders().get(
                CorsResponseDecorator.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS);
        List<String> accessControlRequestHeaders = new LinkedList<>();
        if (accessControlRequestHeadersHeader != null &&
                !accessControlRequestHeadersHeader.trim().isEmpty()) {
            String[] headers = accessControlRequestHeadersHeader.trim().split(
                    ",");
            for (String header : headers) {
                accessControlRequestHeaders.add(header.trim().toLowerCase(Locale.ENGLISH));
            }
        }

        // Section 6.2.5
        if (!corsSupport.getAllowedHeaders().contains(accessControlRequestMethod)) {
            handleInvalidCORS(request, response);
            return false;
        }

        // Section 6.2.6
        if (!accessControlRequestHeaders.isEmpty()) {
            for (String header : accessControlRequestHeaders) {
                if (!corsSupport.getAllowedHeaders().contains(header)) {
                    handleInvalidCORS(request, response);
                    return false;
                }
            }
        }

        // Section 6.2.7
        if (corsSupport.isAllowCredentials()) {
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                    origin);
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS,
                    "true");
        } else {
            if (anyOriginAllowed) {
                response.getHeaders().add(
                        CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                        "*");
            } else {
                response.getHeaders().add(
                        CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                        origin);
            }
        }

        // Section 6.2.8
        if (preFlightMaxAge > 0) {
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_MAX_AGE,
                    String.valueOf(preFlightMaxAge));
        }

        // Section 6.2.9
        response.getHeaders().add(
                CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_METHODS,
                accessControlRequestMethod);

        // Section 6.2.10
        if ((corsSupport.getAllowedHeaders() != null) && (!corsSupport.getAllowedHeaders().isEmpty())) {
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_HEADERS,
                    join(corsSupport.getAllowedHeaders(), ","));
        }

        return true;

    }
protected boolean handlePreflightCORS(final HttpRequestHolder request,
                                          final HttpResponseHolder response) {

        CORSRequestType requestType = checkRequestType(request);
        if (requestType != CORSRequestType.PRE_FLIGHT) {
            throw new IllegalArgumentException(CorsSupport.CORS_WRONG_TYPE_2);
            //TODO: String replace into above CORSRequestType.PRE_FLIGHT.name().toLowerCase(Locale.ENGLISH)));
        }

        final String origin = request.getHeaders().get(CorsResponseDecorator.REQUEST_HEADER_ORIGIN);

        // Section 6.2.2
        if (!isOriginAllowed(origin)) {
            handleInvalidCORS(request, response);
            return false;
        }

        // Section 6.2.3
        String accessControlRequestMethod = request.getHeaders().get(
                CorsResponseDecorator.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_METHOD);
        if (accessControlRequestMethod == null) {
            handleInvalidCORS(request, response);
            return false;
        } else {
            accessControlRequestMethod = accessControlRequestMethod.trim();
        }

        // Section 6.2.4
        String accessControlRequestHeadersHeader = request.getHeaders().get(
                CorsResponseDecorator.REQUEST_HEADER_ACCESS_CONTROL_REQUEST_HEADERS);
        List<String> accessControlRequestHeaders = new LinkedList<>();
        if (accessControlRequestHeadersHeader != null &&
                !accessControlRequestHeadersHeader.trim().isEmpty()) {
            String[] headers = accessControlRequestHeadersHeader.trim().split(
                    ",");
            for (String header : headers) {
                accessControlRequestHeaders.add(header.trim().toLowerCase(Locale.ENGLISH));
            }
        }

        // Section 6.2.5
        if (!corsSupport.getAllowedHeaders().contains(accessControlRequestMethod)) {
            handleInvalidCORS(request, response);
            return false;
        }

        // Section 6.2.6
        if (!accessControlRequestHeaders.isEmpty()) {
            for (String header : accessControlRequestHeaders) {
                if (!corsSupport.getAllowedHeaders().contains(header)) {
                    handleInvalidCORS(request, response);
                    return false;
                }
            }
        }

        // Section 6.2.7
        if (corsSupport.isAllowCredentials()) {
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                    origin);
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS,
                    "true");
        } else {
            if (anyOriginAllowed) {
                response.getHeaders().add(
                        CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                        "*");
            } else {
                response.getHeaders().add(
                        CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN,
                        origin);
            }
        }

        // Section 6.2.8
        if (preFlightMaxAge > 0) {
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_MAX_AGE,
                    String.valueOf(preFlightMaxAge));
        }

        // Section 6.2.9
        response.getHeaders().add(
                CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_METHODS,
                accessControlRequestMethod);

        // Section 6.2.10
        if ((corsSupport.getAllowedHeaders() != null) && (!corsSupport.getAllowedHeaders().isEmpty())) {
            response.getHeaders().add(
                    CorsResponseDecorator.RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_HEADERS,
                    join(corsSupport.getAllowedHeaders(), ","));
        }

        return true;

    }
Handles CORS pre-flight request.

@param request  request
@param response response
@return return true if pre flight handler.