*/
    public CorsHandler() {
        // Default constructor
    }

    /**
     * CORS header for specifying allowed origin.
     */
    protected static final String ACCESS_CONTROL_ALLOW_ORIGIN = "Access-Control-Allow-Origin";

    /**
     * CORS header for specifying allowed headers.
     */
    protected static final String ACCESS_CONTROL_ALLOW_HEADERS = "Access-Control-Allow-Headers";

    /**

    // Test constants are not modifiable (ensure they're final)
    public void test_constantsAreImmutable() throws Exception {
        Field originField = CorsHandler.class.getDeclaredField("ACCESS_CONTROL_ALLOW_ORIGIN");
        assertTrue("ACCESS_CONTROL_ALLOW_ORIGIN should be final", Modifier.isFinal(originField.getModifiers()));

        Field headersField = CorsHandler.class.getDeclaredField("ACCESS_CONTROL_ALLOW_HEADERS");

        final FessConfig fessConfig = ComponentUtil.getFessConfig();
        final HttpServletResponse httpResponse = (HttpServletResponse) response;
        httpResponse.addHeader(ACCESS_CONTROL_ALLOW_ORIGIN, origin);
        httpResponse.addHeader(ACCESS_CONTROL_ALLOW_METHODS, fessConfig.getApiCorsAllowMethods());
        httpResponse.addHeader(ACCESS_CONTROL_ALLOW_HEADERS, fessConfig.getApiCorsAllowHeaders());