Source:
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest) servletRequest; HttpServletResponse response = (HttpServletResponse) servletResponse; RequestControllerManager service = Framework.getService(RequestControllerManager.class); CORSFilter corsFilter = service.getCorsFilterForRequest(request); CORSConfiguration corsConfig = corsFilter == null ? null : corsFilter.getConfiguration(); String method = request.getMethod(); URI sourceURI = getSourceURI(request); URI targetURI = getTargetURI(request); if (log.isDebugEnabled()) { log.debug("Method: " + method + ", source: " + sourceURI + ", target: " + targetURI); } boolean allow; if (GET.equals(method) || HEAD.equals(method) || OPTIONS.equals(method) || TRACE.equals(method)) { log.debug("Safe method: allow"); allow = true; } else if (sourceAndTargetMatch(sourceURI, targetURI)) { log.debug("Source and target match: allow"); if (targetURI == null) { log.error("Cannot determine target URL for CSRF check"); } allow = true; } else if (corsFilter == null) { log.debug("URL not covered by CORS config: disallow cross-site request"); allow = false; } else if (!corsConfig.isAllowedOrigin(new Origin(sourceURI.toString()))) { log.debug("Origin not allowed by CORS config: disallow cross-site request"); allow = false; } else if (!corsConfig.isSupportedMethod(method)) { log.debug("Method not allowed by CORS config: disallow cross-site request"); allow = false; } else { log.debug("Origin and method allowed by CORS config: allow cross-site request"); allow = true; } if (allow) { if (corsFilter == null) { chain.doFilter(request, response); } else { corsFilter.doFilter(request, response, chain); } return; } String message = "CSRF check failure"; log.warn(message + ": source: " + sourceURI + " does not match target: " + targetURI + " and not allowed by CORS config"); response.sendError(HttpServletResponse.SC_FORBIDDEN, message); }

Target:
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest) servletRequest; HttpServletResponse response = (HttpServletResponse) servletResponse; RequestControllerManager service = Framework.getService(RequestControllerManager.class); CORSFilter corsFilter = service.getCorsFilterForRequest(request); CORSConfiguration corsConfig = corsFilter == null ? null : corsFilter.getConfiguration(); String method = request.getMethod(); URI sourceURI = getSourceURI(request); URI targetURI = getTargetURI(request); if (log.isDebugEnabled()) { log.debug("Method: " + method + ", source: " + sourceURI + ", target: " + targetURI); } boolean allow; if (GET.equals(method) || HEAD.equals(method) || OPTIONS.equals(method) || TRACE.equals(method)) { log.debug("Safe method: allow"); allow = true; } else if (sourceAndTargetMatch(sourceURI, targetURI)) { log.debug("Source and target match: allow"); if (targetURI == null) { log.error("Cannot determine target URL for CSRF check"); } allow = true; } else if (corsConfig == null) { log.debug("URL not covered by CORS config: disallow cross-site request"); allow = false; } else if (!corsConfig.isAllowedOrigin(new Origin(sourceURI.toString()))) { log.debug("Origin not allowed by CORS config: disallow cross-site request"); allow = false; } else if (!corsConfig.isSupportedMethod(method)) { log.debug("Method not allowed by CORS config: disallow cross-site request"); allow = false; } else { log.debug("Origin and method allowed by CORS config: allow cross-site request"); allow = true; } if (allow) { if (corsFilter == null) { chain.doFilter(request, response); } else { corsFilter.doFilter(request, response, chain); } return; } String message = "CSRF check failure"; log.warn(message + ": source: " + sourceURI + " does not match target: " + targetURI + " and not allowed by CORS config"); response.sendError(HttpServletResponse.SC_FORBIDDEN, message); }