Updates after review.

Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
jetty · Jan 10, 2024 · d735933 · d735933
1 parent b2a0ded
commit d735933
Showing 1 changed file with 10 additions and 8 deletions.
diff --git a/...-core/jetty-server/src/main/java/org/eclipse/jetty/server/handler/CrossOriginHandler.java b/...-core/jetty-server/src/main/java/org/eclipse/jetty/server/handler/CrossOriginHandler.java
@@ -74,6 +74,7 @@ public class CrossOriginHandler extends Handler.Wrapper
     private final Set<Pattern> allowedTimingOriginPatterns = new LinkedHashSet<>();
     private PreEncodedHttpField accessControlAllowMethodsField;
     private PreEncodedHttpField accessControlAllowHeadersField;
+    private PreEncodedHttpField accessControlExposeHeadersField;
     private PreEncodedHttpField accessControlMaxAge;
 
     /**
@@ -101,7 +102,7 @@ public void setAllowCredentials(boolean allow)
     }
 
     /**
-     * @return the set of allowed headers in a cross-origin request
+     * @return the immutable set of allowed headers in a cross-origin request
      */
     @ManagedAttribute("The set of allowed headers in a cross-origin request")
     public Set<String> getAllowedHeaders()
@@ -128,7 +129,7 @@ public void setAllowedHeaders(Set<String> headers)
     }
 
     /**
-     * @return the set of allowed methods in a cross-origin request
+     * @return the immutable set of allowed methods in a cross-origin request
      */
     @ManagedAttribute("The set of allowed methods in a cross-origin request")
     public Set<String> getAllowedMethods()
@@ -153,7 +154,7 @@ public void setAllowedMethods(Set<String> methods)
     }
 
     /**
-     * @return the set of allowed origin regex strings in a cross-origin request
+     * @return the immutable set of allowed origin regex strings in a cross-origin request
      */
     @ManagedAttribute("The set of allowed origin regex strings in a cross-origin request")
     public Set<String> getAllowedOriginPatterns()
@@ -184,7 +185,7 @@ public void setAllowedOriginPatterns(Set<String> origins)
     }
 
     /**
-     * @return the set of allowed timing origin regex strings in a cross-origin request
+     * @return the immutable set of allowed timing origin regex strings in a cross-origin request
      */
     @ManagedAttribute("The set of allowed timing origin regex strings in a cross-origin request")
     public Set<String> getAllowedTimingOriginPatterns()
@@ -265,7 +266,7 @@ public void setDeliverNonAllowedOriginWebSocketUpgradeRequests(boolean deliverNo
     }
 
     /**
-     * @return the set of headers exposed in a cross-origin response
+     * @return the immutable set of headers exposed in a cross-origin response
      */
     @ManagedAttribute("The set of headers exposed in a cross-origin response")
     public Set<String> getExposedHeaders()
@@ -311,6 +312,7 @@ protected void doStart() throws Exception
         resolveAllowedTimingOrigins();
         accessControlAllowMethodsField = new PreEncodedHttpField(HttpHeader.ACCESS_CONTROL_ALLOW_METHODS, String.join(",", getAllowedMethods()));
         accessControlAllowHeadersField = new PreEncodedHttpField(HttpHeader.ACCESS_CONTROL_ALLOW_HEADERS, String.join(",", getAllowedHeaders()));
+        accessControlExposeHeadersField = new PreEncodedHttpField(HttpHeader.ACCESS_CONTROL_EXPOSE_HEADERS, String.join(",", getExposedHeaders()));
         accessControlMaxAge = new PreEncodedHttpField(HttpHeader.ACCESS_CONTROL_MAX_AGE, getPreflightMaxAge().toSeconds());
         super.doStart();
     }
@@ -475,7 +477,7 @@ private void handleSimpleResponse(String origin, Response response)
             headers.put(ACCESS_CONTROL_ALLOW_CREDENTIALS_TRUE);
         Set<String> exposedHeaders = getExposedHeaders();
         if (!exposedHeaders.isEmpty())
-            headers.put(HttpHeader.ACCESS_CONTROL_EXPOSE_HEADERS, String.join(",", exposedHeaders));
+            headers.put(accessControlExposeHeadersField);
     }
 
     private void resolveAllowedOrigins()
@@ -492,7 +494,7 @@ private void resolveAllowedOrigins()
                 return;
             }
 
-            allowedOriginPatterns.add(Pattern.compile(allowedOrigin));
+            allowedOriginPatterns.add(Pattern.compile(allowedOrigin, Pattern.CASE_INSENSITIVE));
         }
     }
 
@@ -510,7 +512,7 @@ private void resolveAllowedTimingOrigins()
                 return;
             }
 
-            allowedTimingOriginPatterns.add(Pattern.compile(allowedTimingOrigin));
+            allowedTimingOriginPatterns.add(Pattern.compile(allowedTimingOrigin, Pattern.CASE_INSENSITIVE));
         }
     }