Join GitHub today
GitHub is home to over 36 million developers working together to host and review code, manage projects, and build software together.Sign up
DefaultCorsProcessor relies on Servlet 3 specific methods [SPR-12885] #17483
The getHeader methods in the HttpServletResponse are 3.0 specific and may not be present. We've added some checks before in ServletServerHttpResponse for similar reasons (checking if the response has CORS headers already) and the check is only successful in Servlet 3+ environments.
Rather than re-implementing this or extracting it, I think it would make sense for DefaultCorsProcessor to create an instance of ServletServerHttpResponse and use it throughout instead of using the HttpServletRequest/Response directly.
There are added benefits to doing this. It will simplify access to header values via HttpHeaders and it also gives a reason to encapsulate CORS related header manipulation in HttpHeaders.
This issue is a sub-task of #13916