@Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException,
            ServletException {
        HttpServletRequest httpReq = (HttpServletRequest) request;
        HttpServletResponse httpResp = (HttpServletResponse) response;

        if (isPreflightRequest(httpReq) && originIsAllowed(httpReq)) {
            httpResp.setHeader("Access-Control-Allow-Origin", httpReq.getHeader("Origin")); 
            if(!allowedCorsOrigins.contains("*")) {
                httpResp.setHeader("Vary", "Origin"); 
            }
            httpResp.setHeader("Access-Control-Allow-Credentials", "true"); 
            httpResp.setHeader("Access-Control-Max-Age", "1800"); 
            httpResp.setHeader("Access-Control-Allow-Methods", "DELETE,GET,HEAD,PATCH,POST,PUT");
            httpResp.setHeader("Access-Control-Allow-Headers", "X-Requested-With,Content-Type,Accept,Origin,Authorization"); 
            httpResp.setHeader("Access-Control-Expose-Headers", "X-Apiman-Error,Total-Count,X-Total-Count"); 
        } else {
            if (hasOriginHeader(httpReq) && originIsAllowed(httpReq)) {
                httpResp.setHeader("Access-Control-Allow-Origin", httpReq.getHeader("Origin")); 
                if(!allowedCorsOrigins.contains("*")){
                    httpResp.setHeader("Vary", "Origin"); 
                }
                httpResp.setHeader("Access-Control-Allow-Credentials", "true"); 
                httpResp.setHeader("Access-Control-Expose-Headers", "X-Apiman-Error,Total-Count,X-Total-Count");
            }
            chain.doFilter(httpReq, httpResp);
        }
    }
@see javax.servlet.Filter#doFilter(javax.servlet.ServletRequest, javax.servlet.ServletResponse, javax.servlet.FilterChain)
common/servlet/src/main/java/io/apiman/common/servlet/ApimanCorsFilter.java