Repository: netty/netty
File: codec-http/src/main/java/io/netty/handler/codec/http/cors/CorsHandler.java (Java)

Code before:
            request = (HttpRequest) msg;
            final String origin = request.headers().get(HttpHeaderNames.ORIGIN);
            config = getForOrigin(origin);
            if (isPreflightRequest(request)) {
                handlePreflight(ctx, request);
                // Expect an EmptyLastHttpContent next from HttpServerCodec, mark to discard.
                discardNextEmptyLast = true;
                return;
            }
            if (isShortCircuit && !(origin == null || config != null)) {
                forbidden(ctx, request);
                return;
            }
        }

        if (discardNextEmptyLast && msg instanceof LastHttpContent) {
            discardNextEmptyLast = false;
            LastHttpContent last = (LastHttpContent) msg;
            if (last == LastHttpContent.EMPTY_LAST_CONTENT) {
                ReferenceCountUtil.release(last);
                return;
            }
        }

        ctx.fireChannelRead(msg);
    }

    private void handlePreflight(final ChannelHandlerContext ctx, final HttpRequest request) {
        final HttpResponse response = new DefaultFullHttpResponse(
                request.protocolVersion(),
                OK,
                Unpooled.buffer(0),
                DefaultHttpHeadersFactory.headersFactory().withCombiningHeaders(true),
                DefaultHttpHeadersFactory.trailersFactory().withCombiningHeaders(true));
        if (setOrigin(response)) {
            setAllowMethods(response);
            setAllowHeaders(response);
            setAllowCredentials(response);
            setMaxAge(response);
            setPreflightHeaders(response);
            setAllowPrivateNetwork(response);
        }
        if (!response.headers().contains(HttpHeaderNames.CONTENT_LENGTH)) {
            response.headers().set(HttpHeaderNames.CONTENT_LENGTH, HttpHeaderValues.ZERO);
        }
        release(request);
        respond(ctx, request, response);
    }

    /**
     * This is a non CORS specification feature which enables the setting of preflight

Review comment (suggestion):
after looking more into the PR I think this is not robust at all and we need to implement this differently. 

So what we really should do is basically keep track if we forward the `HttpRequest` to the next handler and if this is not the case consume / release any following `HttpContent`, `LastHttpContent` until the next `HttpRequest` is forwarded. 

Code after:
            request = (HttpRequest) msg;
            final String origin = request.headers().get(HttpHeaderNames.ORIGIN);
            config = getForOrigin(origin);
            if (isPreflightRequest(request)) {
                handlePreflight(ctx, request);
                // Enable consumeContent so that all following HttpContent
                // for this request will be released and not propagated downstream.
                consumeContent = true;
                return;
            }
            if (isShortCircuit && !(origin == null || config != null)) {
                forbidden(ctx, request);
                consumeContent = true;
                return;
            }

            // This request is forwarded, stop discarding
            consumeContent = false;
            ctx.fireChannelRead(msg);
            return;
        }

        if (consumeContent && (msg instanceof HttpContent)) {
            ReferenceCountUtil.release(msg);
            return;
        }

        ctx.fireChannelRead(msg);
    }

    private void handlePreflight(final ChannelHandlerContext ctx, final HttpRequest request) {
        final HttpResponse response = new DefaultFullHttpResponse(
                request.protocolVersion(),
                OK,
                Unpooled.buffer(0),
                DefaultHttpHeadersFactory.headersFactory().withCombiningHeaders(true),
                DefaultHttpHeadersFactory.trailersFactory().withCombiningHeaders(true));
        if (setOrigin(response)) {
            setAllowMethods(response);
            setAllowHeaders(response);
            setAllowCredentials(response);
            setMaxAge(response);
            setPreflightHeaders(response);
            setAllowPrivateNetwork(response);
        }
        if (!response.headers().contains(HttpHeaderNames.CONTENT_LENGTH)) {
            response.headers().set(HttpHeaderNames.CONTENT_LENGTH, HttpHeaderValues.ZERO);
        }
        release(request);
        respond(ctx, request, response);
    }