Adds the Access-Control-Allow-Credentials to the response
        if the cors settings indicates it should be set.
428854
def _process_credentials(self, req, resp, origin):
        
        if self._cors_config['allow_credentials_all_origins']:
            self._set_allow_credentials(resp)
            return True

        if origin in self._cors_config['allow_credentials_origins_list']:
            self._set_allow_credentials(resp)
            return True

        credentials_regex = self._cors_config['allow_credentials_origins_regex']
        if credentials_regex:
            if credentials_regex.match(origin):
                self._set_allow_credentials(resp)
                return True

        return False
1308218
async def _on_response_prepare(self,
                                   request: web.Request,
                                   response: web.StreamResponse):
        
        if (not self._router_adapter.is_cors_enabled_on_request(request) or
                self._router_adapter.is_preflight_request(request)):
            # Either not CORS enabled route, or preflight request which is
            # handled in its own handler.
            return

        # Processing response of non-preflight CORS-enabled request.

        config = self._router_adapter.get_non_preflight_request_config(request)

        # Handle according to part 6.1 of the CORS specification.

        origin = request.headers.get(hdrs.ORIGIN)
        if origin is None:
            # Terminate CORS according to CORS 6.1.1.
            return

        options = config.get(origin, config.get("*"))
        if options is None:
            # Terminate CORS according to CORS 6.1.2.
            return

        assert hdrs.ACCESS_CONTROL_ALLOW_ORIGIN not in response.headers
        assert hdrs.ACCESS_CONTROL_ALLOW_CREDENTIALS not in response.headers
        assert hdrs.ACCESS_CONTROL_EXPOSE_HEADERS not in response.headers

        # Process according to CORS 6.1.4.
        # Set exposed headers (server headers exposed to client) before
        # setting any other headers.
        if options.expose_headers == "*":
            # Expose all headers that are set in response.
            exposed_headers = \
                frozenset(response.headers.keys()) - _SIMPLE_RESPONSE_HEADERS
            response.headers[hdrs.ACCESS_CONTROL_EXPOSE_HEADERS] = \
                ",".join(exposed_headers)

        elif options.expose_headers:
            # Expose predefined list of headers.
            response.headers[hdrs.ACCESS_CONTROL_EXPOSE_HEADERS] = \
                ",".join(options.expose_headers)

        # Process according to CORS 6.1.3.
        # Set allowed origin.
        response.headers[hdrs.ACCESS_CONTROL_ALLOW_ORIGIN] = origin
        if options.allow_credentials:
            # Set allowed credentials.
            response.headers[hdrs.ACCESS_CONTROL_ALLOW_CREDENTIALS] = _TRUE
48811
private function setAccessToken()
    {
        $url = $this->client->url . '/identity/oauth/token';
        $clientId = $this->client->clientId;
        $clientSecret = $this->client->clientSecret;
        $queryString = "?grant_type=client_credentials&client_id=$clientId&client_secret=$clientSecret";

        $response = json_decode(
            $this->client->guzzle
                ->request('GET', $url . $queryString)
                ->getBody()
                ->getContents()
        );

        $this->client->setAccessToken($response->access_token);
    }
1060447
function authorize (req, res, next) {
  var params = req.connectParams
  var responseTypes = params.response_type.trim().split(' ')
  var responseMode = (params.response_mode && params.response_mode.trim()) ||
    (params.response_type === 'code' ||
      params.response_type === 'none') ? '?' : '#'

  // ACCESS GRANTED
  if (params.authorize === 'true') {
    // compose the response
    async.waterfall([

      function includeAccessToken (callback) {
        if (responseTypes.indexOf('token') !== -1) {
          AccessToken.issue(req, function (err, response) {
            if (err) { return callback(err) }
            callback(null, response)
          })

        // initialize an empty response
        } else {
          callback(null, {})
        }
      },

      function includeAuthorizationCode (response, callback) {
        if (responseTypes.indexOf('code') !== -1) {
          AuthorizationCode.insert({
            client_id: req.client._id,
            redirect_uri: params.redirect_uri,
            nonce: params.nonce,
            max_age: parseInt(params.max_age, 10) || req.client.default_max_age,
            user_id: req.user._id,
            scope: req.scope

          }, function (err, ac) {
            if (err) { return callback(err) }
            response.code = ac.code
            callback(null, response)
          })

        // pass through to next
        } else {
          callback(null, response)
        }
      },

      function includeIDToken (response, callback) {
        if (responseTypes.indexOf('id_token') !== -1) {
          var shasum, hash, atHash

          if (response.access_token) {
            shasum = crypto.createHash('sha256')
            shasum.update(response.access_token)
            hash = shasum.digest('hex')
            atHash = hash.slice(0, hash.length / 2)
          }

          var idToken = new IDToken({
            iss: settings.issuer,
            sub: req.user._id,
            aud: req.client._id,
            exp: nowSeconds(response.expires_in),
            nonce: params.nonce,
            at_hash: atHash,
            amr: req.session.amr
          })

          response.id_token = idToken.encode(settings.keys.sig.prv)
        }

        callback(null, response)
      }

    ], function (err, response) {
      if (err) { return next(err) }

      if (params.state) {
        response.state = params.state
      }

      // Set the OP browser state.
      var opbs = req.session.opbs

      // if responseTypes includes id_token or token
      // calculate session_state and add to response
      if (responseTypes.indexOf('id_token') !== -1 ||
        responseTypes.indexOf('token') !== -1) {
        var session = sessionState(req.client, req.client.client_uri, opbs)
        response.session_state = session
      }

      res.redirect(
        params.redirect_uri + responseMode + qs.stringify(response)
      )
    })

  // ACCESS DENIED
  } else {
    res.redirect(params.redirect_uri + '?error=access_denied')
  }
}
1241865
def set_credentials(self, username, password):
        
        if username is not None:
            self._username = username

        if password is not None:
            self._password = password
546248
def allow_cors(func):
    """"""
    def wrapper(*args, **kwargs):
        response.headers['Access-Control-Allow-Origin'] = '*'
        response.headers['Access-Control-Allow-Methods'] = \
            'PUT, GET, POST, DELETE, OPTIONS'
        response.headers['Access-Control-Allow-Headers'] = \
            'Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token'
        return func(*args, **kwargs)
    return wrapper
62666
def cross_origin_headers(self):
        """"""
        if not self.is_cross_origin():
            return False
        # we allow everything
        self.send_header("Access-Control-Allow-Methods",
                         "GET, POST, PUT, DELETE, HEAD")
        allow_headers = _getheader(self.headers,
                                   'access-control-request-headers')
        if allow_headers is not None:
            self.send_header("Access-Control-Allow-Headers", allow_headers)
        self.send_header("Access-Control-Allow-Origin", "*")
        self.send_header("Access-Control-Allow-Credentials", "true")
        return allow_headers is not None
1190540
def allow_origins(self, *origins, methods=None, max_age=None, credentials=None, headers=None, **overrides):
        """"""
        response_headers = {}
        if origins:
            @hug.response_middleware()
            def process_data(request, response, resource):
                if 'ORIGIN' in request.headers:
                    origin = request.headers['ORIGIN']
                    if origin in origins:
                        response.set_header('Access-Control-Allow-Origin', origin)
        else:
            response_headers['Access-Control-Allow-Origin'] = '*'

        if methods:
            response_headers['Access-Control-Allow-Methods'] = ', '.join(methods)
        if max_age:
            response_headers['Access-Control-Max-Age'] = max_age
        if credentials:
            response_headers['Access-Control-Allow-Credentials'] = str(credentials).lower()
        if headers:
            response_headers['Access-Control-Allow-Headers'] = headers
        return self.add_response_headers(response_headers, **overrides)
374510
private void configureCors(Environment environment) {
        Dynamic filter = environment.servlets().addFilter("CORS", CrossOriginFilter.class);
        filter.addMappingForUrlPatterns(EnumSet.allOf(DispatcherType.class), true, "/*");
        filter.setInitParameter(CrossOriginFilter.ALLOWED_METHODS_PARAM, "GET,PUT,POST,DELETE,OPTIONS");
        filter.setInitParameter(CrossOriginFilter.ALLOWED_ORIGINS_PARAM, "*");
        filter.setInitParameter(CrossOriginFilter.ACCESS_CONTROL_ALLOW_ORIGIN_HEADER, "*");
        filter.setInitParameter("allowedHeaders", "Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin");
        filter.setInitParameter("allowCredentials", "true");
    }
610448
def after_request(response):
    
    response.headers.add('Access-Control-Allow-Origin', '*')
    response.headers.add('Access-Control-Allow-Headers', 'Content-Type,Authorization')
    response.headers.add('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE')
    return response
941220
function accept(req, res, cb) {
	var u = url.parse(req.url, true),
		path = u.pathname

	if(/^\/api\/?$/.test(path)) {
		messageInit({cb:(cb || nop), req:req, res:res, path:path, query:u.query, u:u})
		return;
	}

	if(req.method == "OPTIONS") {
		res.writeHead(200, {
			"Access-Control-Allow-Origin": "*",	// to support cross-domain script execution of our api
			"Access-Control-Max-Age": "0",
		})
		res.end()
		return;
	}

	www(req, res)					// everything else handled by paperboy
}
1363453
function(req, res, next) {
                    if (req.headers.origin === undefined) {
                        res.setHeader('Access-Control-Allow-Origin', "*");
                    } else {
                        res.setHeader('Access-Control-Allow-Origin', req.headers.origin);
                    }
                    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
                    console.log(req.method + " on " + req.originalUrl);
                    if (req.method === "OPTIONS") {
                        res.setHeader('Access-Control-Allow-Headers', 'content-type');
                        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
                        res.setHeader('Content-Length', '0');
                        res.setHeader('Content-Type', 'application/json; charset=utf-8');
                        grunt.file.read(req.originalUrl.split("?")[0]);
                        //res.write(body);
                        res.end("200");
                        //next();
                    } else {
                        next();
                    }
                }
463222
public static function attachHeaders($response)
	{
		$response->headers->set('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
		$response->headers->set('Access-Control-Allow-Headers', config('api.cors_allowed_headers', 'Origin, Content-Type, Accept, Authorization, X-Requested-With'));
		$response->headers->set('Access-Control-Allow-Credentials', 'true');
		
		if ($exposed = config('api.cors_exposed_headers', 'Pagination-Page, Pagination-Num, Pagination-Total, Pagination-Last-Page')) {
			$response->headers->set('Access-Control-Expose-Headers', $exposed);
		}
	}
802514
protected function configureCorsIfEnabled(): void
    {
        $reflection = new \ReflectionClass($this);
        $reader = new AnnotationReader();

        $annotation = $reader->getClassAnnotation($reflection, CORS::class);

        if (empty($annotation)) {
            return;
        }

        $corsConfig = [
            'Access-Control-Allow-Origin' => $annotation->origins ?? '*',
            'Access-Control-Allow-Methods' => $annotation->methods ?? 'GET, POST, PUT, DELETE, OPTIONS',
            'Access-Control-Allow-Headers' => $annotation->headers ?? '*',
            'Access-Control-Allow-Credentials' => $annotation->credentials ?? true,
            'Access-Control-Allow-Max-Age' => $annotation->maxAge ?? 3600
        ];

        foreach ($corsConfig as $key => $value) {
            $this->getResponse()->headers->set($key, $value);
        }
    }
925458
function cors(response) {
  if (response) {
    const headers = response.headers || {};
    headers["Access-Control-Allow-Origin"] = "*"; // Required for CORS support to work
    headers["Access-Control-Allow-Credentials"] = true;  // Required for cookies, authorization headers with HTTPS
    response.headers = headers;
  }
  return response;
}
615086
def cors_setup(self, request):
        
        def cors_headers(request, response):
            if request.method.lower() == 'options':
                response.headers.update({
                    '-'.join([p.capitalize() for p in k.split('_')]): v
                    for k, v in self.cors_options.items()
                })
            else:
                origin = self.cors_options.get('access_control_allow_origin', '*')
                expose_headers = self.cors_options.get('access_control_expose_headers', '')
                response.headers['Access-Control-Allow-Origin'] = origin
                if expose_headers:
                    response.headers['Access-Control-Expose-Headers'] = expose_headers

        # setup the CORS supported response
        request.add_response_callback(cors_headers)
271031
@Nullable
    private CorsPolicy setCorsOrigin(ServiceRequestContext ctx, HttpRequest request, HttpHeaders headers) {
        if (!config.isEnabled()) {
            return null;
        }

        final String origin = request.headers().get(HttpHeaderNames.ORIGIN);
        if (origin != null) {
            final CorsPolicy policy = config.getPolicy(origin, ctx.pathMappingContext());
            if (policy == null) {
                logger.debug(
                        "{} There is no CORS policy configured for the request origin '{}' and the path '{}'.",
                        ctx, origin, ctx.path());
                return null;
            }
            if (NULL_ORIGIN.equals(origin)) {
                setCorsNullOrigin(headers);
                return policy;
            }
            if (config.isAnyOriginSupported()) {
                if (policy.isCredentialsAllowed()) {
                    echoCorsRequestOrigin(request, headers);
                    setCorsVaryHeader(headers);
                } else {
                    setCorsAnyOrigin(headers);
                }
                return policy;
            }
            setCorsOrigin(headers, origin);
            setCorsVaryHeader(headers);
            return policy;
        }
        return null;
    }