private void doCors() {
        String origin = requestHeaders.get(ORIGIN_KEY);
        String host = requestHeaders.get(HOST_KEY);
        String[] acRequestHeaders = split(requestHeaders.get(AC_REQUEST_HEADERS_KEY));

        // Is the request an allowed origin? If so, echo back the allowed origin.
        appendMandatory(AC_ALLOW_ORIGIN_KEY, origin,
                "", config.isAllowedOrigin(origin, host), Messages.getString("CorsConnector.origin_not_permitted")); //$NON-NLS-1$ //$NON-NLS-2$

        // Do nothing on failure
        appendOptional(AC_ALLOW_CREDENTIALS_KEY, Boolean.TRUE.toString(), config.isAllowCredentials(), null);

        // Do nothing if there are no exposed headers.
        appendOptional(AC_EXPOSE_HEADERS_KEY, join(config.getExposeHeaders()), !config.getExposeHeaders()
                .isEmpty(), null);

        if (!isSimpleRequest(acRequestHeaders)) { // Should be a preflight request or real request
            if (request.getType().equals(HttpHelper.OPTIONS) &&
                    requestHeaders.get(AC_REQUEST_METHOD_KEY) != null) {
                String[] acRequestMethods = split(requestHeaders.get(AC_REQUEST_METHOD_KEY));

                // Append allowed methods even if we return an error.
                String allowMethods = join(config.getAllowMethods());

                appendMandatory(AC_ALLOW_METHODS_KEY, allowMethods, allowMethods,
                        config.isAllowedMethod(acRequestMethods), Messages.getString("CorsConnector.requested_method_not_allowed")); //$NON-NLS-1$

                // Append allowed headers even if we return an error.
                if (!config.getAllowHeaders().isEmpty() && acRequestHeaders != null) {
                    appendOptional(AC_ALLOW_HEADERS_KEY, join(config.getAllowHeaders()),
                            config.isAllowedHeader(acRequestHeaders), Messages.getString("CorsConnector.requested_header_not_allowed")); //$NON-NLS-1$
                }

                appendOptional(AC_MAX_AGE_KEY, config.getMaxAge().toString(), config.getMaxAge() != null,
                        null);

                // Only short-circuit if it's a *successful* preflight request
                if (!isFailure()) {
                    shortCircuit = true;
                }
            }
        }
    }
Is the request related to CORS? Helps avoid unnecessary object creation.

@param request the request
@return true if CORS is a request
plugins/cors-policy/src/main/java/io/apiman/plugins/cors_policy/CorsConnector.java