@Override
    protected void doApply(ApiRequest request, IPolicyContext context, HeaderAllowDenyBean config,
                           IPolicyChain<ApiRequest> chain) {

        // short circuit if no rules
        if (null == config.getEntries() || config.getEntries().isEmpty()) {
            chain.doApply(request);
            return;
        }

        for (HeaderEntryBean entry : config.getEntries()) {
            final List<String> headerValues = request.getHeaders().getAll(entry.getHeaderName().toLowerCase());

            // no such request header
            if (headerValues.isEmpty()) {
                if (!entry.isAllowIfHeaderMissing()) {
                    chain.doFailure(new PolicyFailure(PolicyFailureType.Authorization,
                            HttpURLConnection.HTTP_FORBIDDEN, MESSAGES.format("Failure.HeaderMissing", entry.getHeaderName()))); //$NON-NLS-1$
                    return;
                }
                continue;
            }

            switch (checkRequestPermitted(entry, headerValues)) {
                case NO_MATCH:
                    if (!entry.isAllowIfNoRulesMatch()) {
                        chain.doFailure(new PolicyFailure(PolicyFailureType.Authorization,
                                HttpURLConnection.HTTP_FORBIDDEN, MESSAGES.format("Failure.NoRulesMatch"))); //$NON-NLS-1$
                        return;
                    }
                    break;

                case ALLOW:
                    continue;

                case DENY:
                    chain.doFailure(new PolicyFailure(PolicyFailureType.Authorization,
                            HttpURLConnection.HTTP_FORBIDDEN, MESSAGES.format("Failure.HeaderValueNotPermitted", entry.getHeaderName(), headerValues))); //$NON-NLS-1$
                    return;
            }
        }

        chain.doApply(request);
    }
@see io.apiman.gateway.engine.policies.AbstractMappedPolicy#doApply(io.apiman.gateway.engine.beans.ApiRequest, io.apiman.gateway.engine.policy.IPolicyContext, java.lang.Object, io.apiman.gateway.engine.policy.IPolicyChain)
plugins/header-allow-deny-policy/src/main/java/io/apiman/plugins/headerallowdeny/HeaderAllowDenyPolicy.java