Proposal for Support CORS (Cross-Origin Resource Sharing) #216

Add a Filter to handle multiple resources and a Helper to add CORS headers manually.
Thanks a lot Andie for this detailed code review and enhancement
suggestions. Very timely as we are working on closing the RF2.3 dev cycle.
Manuel, can you take those into account in his updated pull request.
Jerome

On Wed, Oct 29, 2014 at 6:39 AM, Andy Dennie <notifications@github.com>
wrote:

> In modules/org.restlet/src/org/restlet/engine/cors/CorsResponseHelper.java:
>
> > +     * @param request
> > +     *            The request to handle.
> > +     */
> > +    public boolean isCorsRequest(Request request) {
> > +        return request.getHeaders().getValues("Origin") != null;
> > +    }
> > +
> > +    /**
> > +     * Add CORS headers to response
> > +     *
> > +     * @param request
> > +     *            The request to handle.
> > +     * @param response
> > +     *            The response
> > +     */
> > +    public void addCorsResponseHeaders(Request request, Response response) {
>
> To be W3C compliant, the logic in this method needs to distinguish between
> pre-flight OPTIONS requests and normal requests.
>
> For pre-flight OPTIONS requests, you need to:
>
>    - check whether the request origin is allowed; if not, do not add any
>    CORS headers in the response
>    - check that a method was requested and that the requested method is
>    allowed; if not, do not add any CORS headers to the response
>    - check that ALL of the requested headers are allowed; if not, do not
>    add any CORS headers to the response.
>    - check whether the resource supports credentials. If so, add an
>    Access-Control-Allow-Origin header for the origin,and a
>    Access-Control-Allow-Credentials header with the value "true". Otherwise,
>    add an Access-Control-Allow-Origin header, with either the value of the
>    Origin header (if not all origins are allowed) or the string "*" (if all
>    origins are allowed).
>    - if the resource has a configured maximum caching age configured, add
>    a Access-Control-Max-Age header with the value of the number of seconds the
>    user agent is allowed to cache the result of the request.
>    - add the Access-Control-Allow-Methods header and the
>    Access-Control-Allow-Headers headers.
>
> For normal requests, you need to:
>
>    - check whether the request origin is allowed; if not, do not add any
>    CORS headers in the response
>    - check whether the resource supports credentials. If so, add an
>    Access-Control-Allow-Origin header for the origin, and a
>    Access-Control-Allow-Credentials header with the value "true". Otherwise,
>    add an Access-Control-Allow-Origin header, with either the value of the
>    Origin header (if not all origins are allowed) or the string "*" (if all
>    origins are allowed).
>    - add an Access-Control-Expose-Headers header for any headers which
>    the resource should expose
>    - note: for normal requests, the Access-Control-Allow-Methods and
>    Access-Control-Allow-Headers headers are not returned in the response;
>    those are only for pre-flight OPTIONS requests.
>
> See http://www.w3.org/TR/cors sections 6.1 and 6.2 for details. Also, if
> interested, see
> https://github.com/adennie/vroom/blob/master/vroom-core/src/main/java/com/fizzbuzz/vroom/core/api/filter/CorsFilter.java
> for some implementation logic which you are free to copy if you like.
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/restlet/restlet-framework-java/pull/961/files#r19537341>
> .
>