Add preflight support to HttpAuthenticationFilter

[jepsar]

It would be nice if there was native (optional) support to always grant access to preflight requests.

https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request

In our JAX RS project, we added this to our filter:

  @Override
  protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
    if (isPreflightRequest(request)) {
      return true;
    }
    return super.isAccessAllowed(request, response, mappedValue);
  }

  protected boolean isPreflightRequest(ServletRequest request) {
    HttpServletRequest httpRequest = WebUtils.toHttp(request);
    return httpRequest.getHeader("Origin") != null && httpRequest.getMethod().equals("OPTIONS");
  }

[lprimak]

Contributions are welcome :) Thank you

[jepsar]

Let me see what I can do.

[lprimak]

@jepsar any update please?

[jepsar]

I currently have some backlog of PrimeFaces work. Not sure when I can have a look at this issue.

[jub0bs]

@jepsar Be careful: not all OPTIONS request including an Origin header are preflight requests. To be sure that you're dealing with a preflight request, you should check that the request also includes an Access-Control-Request-Method. More details in https://fetch.spec.whatwg.org/#cors-preflight-request