Package org.apache.tapestry5.http.services

# Interface CorsHandlerHelper

All Known Implementing Classes:
  `CorsHandlerHelperImpl`

public interface CorsHandlerHelper
Service that provides useful methods for `CorsHandler` implementations.

Since:
  5.8.2
See Also:
  - `CorsHandler`

- ## Field Summary

  Fields
  Modifier and Type
  Field
  Description
  `static final String`
  `ALLOW_CREDENTIALS_HEADER`
  Name of the Access-Control-Allow-Credentials HTTP header.
  `static final String`
  `ALLOW_HEADERS_HEADER`
  Name of the Access-Control-Allow-Headers HTTP header.
  `static final String`
  `ALLOW_METHODS_HEADER`
  Name of the Access-Control-Allow-Methods HTTP header.
  `static final String`
  `ALLOW_ORIGIN_HEADER`
  Name of the Access-Control-Allow-Origin HTTP header.
  `static final String`
  `EXPOSE_HEADERS_HEADER`
  Name of the Access-Control-Expose-Headers HTTP header.
  `static final String`
  `MAX_AGE_HEADER`
  Name of the Access-Control-Max-Age HTTP header.
  `static final String`
  `OPTIONS_METHOD`
  OPTIONS HTTP method name.
  `static final String`
  `ORIGIN_HEADER`
  Name of the Origin HTTP header.
  `static final String`
  `ORIGIN_WILDCARD`
  The CORS Origin wildcard.
  `static final String`
  `REQUEST_HEADERS_HEADER`
  Name of the Access-Control-Request-Headers HTTP header.
  `static final String`
  `VARY_HEADER`
  Name of the Vary HTTP header.

- ## Method Summary

  Modifier and Type
  Method
  Description
  `default void`
  `addValueToVaryHeader(javax.servlet.http.HttpServletResponse response, String value)`
  Adds a value to the Vary HTTP header.
  `void`
  `configureAllowedHeaders(javax.servlet.http.HttpServletResponse response, javax.servlet.http.HttpServletRequest request)`
  Conditionally the Access-Control-Request-Headers HTTP header.
  `void`
  `configureCredentials(javax.servlet.http.HttpServletResponse response)`
  Conditionally sets the Access-Control-Allow-Credentials HTTP header.
  `void`
  `configureExposeHeaders(javax.servlet.http.HttpServletResponse response)`
  Conditionally sets the Access-Control-Expose-Headers HTTP header.
  `void`
  `configureMaxAge(javax.servlet.http.HttpServletResponse response)`
  Conditionally sets the Access-Control-Max-Age HTTP header.
  `void`
  `configureMethods(javax.servlet.http.HttpServletResponse response)`
  Conditionally sets the Access-Control-Allow-Methods HTTP header in responses to preflight CORS requests.
  `void`
  `configureOrigin(javax.servlet.http.HttpServletResponse response, String value)`
  Sets the Access-Control-Allow-Origin HTTP header with a given value.
  `Optional<String>`
  `getAllowedOrigin(javax.servlet.http.HttpServletRequest request)`
  Returns the origin of this requests, if it's allowed.
  `Optional<String>`
  `getOrigin(javax.servlet.http.HttpServletRequest request)`
  Returns the value of the Origin HTTP header.
  `String`
  `getPath(javax.servlet.http.HttpServletRequest request)`
  Returns the requested URL path, using the same logic as `Request.getPath()`.
  `boolean`
  `isPreflight(javax.servlet.http.HttpServletRequest request)`
  Tells whether this request is a CORS preflight one (i.e.

- ## Field Details

  - ### ORIGIN_HEADER

    static final String ORIGIN_HEADER
    Name of the Origin HTTP header.
    See Also:
      - Constant Field Values

  - ### ALLOW_ORIGIN_HEADER

    static final String ALLOW_ORIGIN_HEADER
    Name of the Access-Control-Allow-Origin HTTP header.
    See Also:
      - Constant Field Values

  - ### ALLOW_CREDENTIALS_HEADER

    static final String ALLOW_CREDENTIALS_HEADER
    Name of the Access-Control-Allow-Credentials HTTP header.
    See Also:
      - Constant Field Values

  - ### ALLOW_METHODS_HEADER

    static final String ALLOW_METHODS_HEADER
    Name of the Access-Control-Allow-Methods HTTP header.
    See Also:
      - Constant Field Values

  - ### REQUEST_HEADERS_HEADER

    static final String REQUEST_HEADERS_HEADER
    Name of the Access-Control-Request-Headers HTTP header.
    See Also:
      - Constant Field Values

  - ### ALLOW_HEADERS_HEADER

    static final String ALLOW_HEADERS_HEADER
    Name of the Access-Control-Allow-Headers HTTP header.
    See Also:
      - Constant Field Values

  - ### EXPOSE_HEADERS_HEADER

    static final String EXPOSE_HEADERS_HEADER
    Name of the Access-Control-Expose-Headers HTTP header.
    See Also:
      - Constant Field Values

  - ### MAX_AGE_HEADER

    static final String MAX_AGE_HEADER
    Name of the Access-Control-Max-Age HTTP header.
    See Also:
      - Constant Field Values

  - ### VARY_HEADER

    static final String VARY_HEADER
    Name of the Vary HTTP header.
    See Also:
      - Constant Field Values

  - ### OPTIONS_METHOD

    static final String OPTIONS_METHOD
    OPTIONS HTTP method name.
    See Also:
      - Constant Field Values

  - ### ORIGIN_WILDCARD

    static final String ORIGIN_WILDCARD
    The CORS Origin wildcard.
    See Also:
      - Constant Field Values

- ## Method Details

  - ### getPath

    String getPath(javax.servlet.http.HttpServletRequest request)
    Returns the requested URL path, using the same logic as `Request.getPath()`.
    Parameters:
      `request` - an `HttpServletRequest`.
    Returns:
      a `String` with the path.

  - ### getOrigin

    Optional<String> getOrigin(javax.servlet.http.HttpServletRequest request)
    Returns the value of the Origin HTTP header.
    Parameters:
      `request` - an `HttpServletRequest`.
    Returns:
      an `Optional` wrapping the Origin HTTP header value.

  - ### isPreflight

    boolean isPreflight(javax.servlet.http.HttpServletRequest request)
    Tells whether this request is a CORS preflight one (i.e. HTTP method OPTION and non-empty Origin HTTP header).
    Parameters:
      `request` - an `HttpServletRequest`.
    Returns:
      `true` if it's a preflight request, `false` otherwise.

  - ### getAllowedOrigin

    Optional<String> getAllowedOrigin(javax.servlet.http.HttpServletRequest request)
    Returns the origin of this requests, if it's allowed.
    Parameters:
      `request` - an `HttpServletRequest`.
    Returns:
      an `Optional` wrapping the allowed origin.
    See Also:
      - `TapestryHttpSymbolConstants.CORS_ALLOWED_ORIGINS`

  - ### configureOrigin

    void configureOrigin(javax.servlet.http.HttpServletResponse response, String value)
    Sets the Access-Control-Allow-Origin HTTP header with a given value.
    Parameters:
      `value` - a String.
      `response` - an `HttpServletResponse` instance.
    See Also:
      - `ALLOW_ORIGIN_HEADER`

  - ### configureCredentials

    void configureCredentials(javax.servlet.http.HttpServletResponse response)
    Conditionally sets the Access-Control-Allow-Credentials HTTP header. Out-of-the-box, this is done based on the `TapestryHttpSymbolConstants.CORS_ALLOW_CREDENTIALS` symbol.
    Parameters:
      `response` - an `HttpServletResponse`.
    See Also:
      - `TapestryHttpSymbolConstants.CORS_ALLOW_CREDENTIALS`

  - ### configureMethods

    void configureMethods(javax.servlet.http.HttpServletResponse response)
    Conditionally sets the Access-Control-Allow-Methods HTTP header in responses to preflight CORS requests. Out-of-the-box, the value comes from `TapestryHttpSymbolConstants.CORS_ALLOW_CREDENTIALS` symbol and the header is only set if the value isn't empty.
    Parameters:
      `response` - an `HttpServletResponse`.
    See Also:
      - `TapestryHttpSymbolConstants.CORS_ALLOW_CREDENTIALS`

  - ### configureAllowedHeaders

    void configureAllowedHeaders(javax.servlet.http.HttpServletResponse response, javax.servlet.http.HttpServletRequest request)
    Conditionally the Access-Control-Request-Headers HTTP header. Out-of-the-box, the value comes from `TapestryHttpSymbolConstants.CORS_ALLOWED_HEADERS` symbol if not empty. Otherwise, it comes from the value of the same HTTP header from the request, also if not empty. Otherwise, the header isn't set.
    Parameters:
      `response` - an `HttpServletResponse`.
      `request` - an `HttpServletRequest`.
    See Also:
      - `TapestryHttpSymbolConstants.CORS_ALLOWED_HEADERS`

  - ### configureExposeHeaders

    void configureExposeHeaders(javax.servlet.http.HttpServletResponse response)
    Conditionally sets the Access-Control-Expose-Headers HTTP header. Out-of-the-box, the value comes from `TapestryHttpSymbolConstants.CORS_EXPOSE_HEADERS` symbol, if not empty. Otherwise, the header isn't set.
    Parameters:
      `response` - an `HttpServletResponse`.
    See Also:
      - `TapestryHttpSymbolConstants.CORS_EXPOSE_HEADERS`

  - ### configureMaxAge

    void configureMaxAge(javax.servlet.http.HttpServletResponse response)
    Conditionally sets the Access-Control-Max-Age HTTP header. Out-of-the-box, the value comes from `TapestryHttpSymbolConstants.CORS_MAX_AGE` symbol, if not empty. Otherwise, the header isn't set.
    Parameters:
      `response` - an `HttpServletResponse`.
    See Also:
      - `TapestryHttpSymbolConstants.CORS_MAX_AGE`

  - ### addValueToVaryHeader

    default void addValueToVaryHeader(javax.servlet.http.HttpServletResponse response, String value)
    Adds a value to the Vary HTTP header.
    Parameters:
      `response` - an `HttpServletResponse` instance.
      `value` - the value to be added.