protected static final String ACCESS_CONTROL_ALLOW_PRIVATE_NETWORK = "Access-Control-Allow-Private-Network";

    /**
     * CORS header for allowing credentials.
     */
    protected static final String ACCESS_CONTROL_ALLOW_CREDENTIALS = "Access-Control-Allow-Credentials";

    /**
     * CORS header for specifying cache duration for preflight requests.
     */
    protected static final String ACCESS_CONTROL_MAX_AGE = "Access-Control-Max-Age";

        Field credentialsField = CorsHandler.class.getDeclaredField("ACCESS_CONTROL_ALLOW_CREDENTIALS");
        assertTrue("ACCESS_CONTROL_ALLOW_CREDENTIALS should be final", Modifier.isFinal(credentialsField.getModifiers()));

        Field maxAgeField = CorsHandler.class.getDeclaredField("ACCESS_CONTROL_MAX_AGE");

        httpResponse.addHeader(ACCESS_CONTROL_ALLOW_HEADERS, fessConfig.getApiCorsAllowHeaders());
        httpResponse.addHeader(ACCESS_CONTROL_MAX_AGE, fessConfig.getApiCorsMaxAge());
        httpResponse.addHeader(ACCESS_CONTROL_ALLOW_CREDENTIALS, fessConfig.getApiCorsAllowCredentials());
    }

      "Access-Control-Allow-Private-Network";

  /** The HTTP {@code Access-Control-Allow-Credentials} header field name. */
  public static final String ACCESS_CONTROL_ALLOW_CREDENTIALS = "Access-Control-Allow-Credentials";

  /** The HTTP {@code Access-Control-Expose-Headers} header field name. */
  public static final String ACCESS_CONTROL_EXPOSE_HEADERS = "Access-Control-Expose-Headers";