java - Correct way to add Restlet 2.3 CORS -

the title says it... correct/recommended way of adding proper cors support restlet 2.3 implements challengeauthenticator allow pre-flight options access header info without authorization header?

originally thought add @options annotation resource interface:

@options void getcorssupport(); 

and implement this:

@override public void getcorssupport() {         series<header> headers = getresponse().getheaders();         headers.set("access-control-expose-headers", "authorization, link, x-ratelimit-limit, x-ratelimit-remaining, x-oauth-scopes, x-accepted-oauth-scopes");          set<string> head = new hashset<>();         head.add("authorization");         head.add("content-type");         head.add("x-requested-with");         getresponse().setaccesscontrolallowheaders(head);          set<method> methods = new hashset<>();         methods.add(method.all);          getresponse().setaccesscontrolallowmethods(methods);         getresponse().setaccesscontrolallowcredentials(true);         series<header> reqheaders = getrequest().getheaders();         string requestorigin = reqheaders.getfirstvalue("origin", false, "*");         getresponse().setaccesscontrolalloworigin(requestorigin);     } 

what expected happen ajax pre-flight options request exempt challengeauthenticator , above headers returned. sadly not case , ajax pre-flight options request subjected challengeauthenticator else. means request fails because hasn't been granted required access-control-allow-origin header.

then did research , found appears possible register corsservice application.

public class webapi extends application {      public webapi() {         getservices().add(createcorsservice());     }     ...        private corsservice createcorsservice() {          corsservice corsservice = new corsservice();          corsservice.setallowedorigins(new hashset(arrays.aslist("*")));         corsservice.setallowedcredentials(true);          corsservice.setallowedcredentials(true);         corsservice.setallowingallrequestedheaders(true);          set<string> allowheaders = new hashset<>();         allowheaders.add("authorization");         allowheaders.add("content-type");         allowheaders.add("x-requested-with");         corsservice.setallowedheaders(allowheaders);          set<string> exposeheaders = new hashset<>();         exposeheaders.add("authorization");         exposeheaders.add("link");         exposeheaders.add("x-ratelimit-limit");         exposeheaders.add("x-ratelimit-remaining");         exposeheaders.add("x-oauth-scopes");         exposeheaders.add("x-accepted-oauth-scopes");         corsservice.setexposedheaders(exposeheaders);          return corsservice;     } } 

i thought might clean way avoid having @options method every service. however, must doing wrong appears nothing @ all.

researching still further found there such thing corsfilter seems instantiated in same way corsservice except gets attached router in createinboundroot() method. don't understand how should implemented work in conjunction challengeauthenticator.

addendum:

• i found this in code suggesting pre-flight should handled.

you need set property of corsservice called "skipresourceforcorsoptions". example:

    corsservice corsservice = new corsservice();     corsservice.setallowingallrequestedheaders(true);     corsservice.setallowedorigins(new hashset(arrays.aslist("*")));     corsservice.setallowedcredentials(true);     corsservice.setskippingresourceforcorsoptions(true); 

here javadocs: http://restlet.com/technical-resources/restlet-framework/javadocs/2.3/jse/api/org/restlet/service/corsservice.html#setskippingresourceforcorsoptions%28boolean%29

a more detailed page added on user guide, @ address: http://restlet.com/technical-resources/restlet-framework/guide/2.3/core/services/cors.