*/
    public CorsHandler() {
        // Default constructor
    }

    /**
     * CORS header for specifying allowed origin.
     */
    protected static final String ACCESS_CONTROL_ALLOW_ORIGIN = "Access-Control-Allow-Origin";

    /**
     * CORS header for specifying allowed headers.
     */
    protected static final String ACCESS_CONTROL_ALLOW_HEADERS = "Access-Control-Allow-Headers";

    /**

    // Test constants are not modifiable (ensure they're final)
    public void test_constantsAreImmutable() throws Exception {
        Field originField = CorsHandler.class.getDeclaredField("ACCESS_CONTROL_ALLOW_ORIGIN");
        assertTrue("ACCESS_CONTROL_ALLOW_ORIGIN should be final", Modifier.isFinal(originField.getModifiers()));

        Field headersField = CorsHandler.class.getDeclaredField("ACCESS_CONTROL_ALLOW_HEADERS");

        final FessConfig fessConfig = ComponentUtil.getFessConfig();
        final HttpServletResponse httpResponse = (HttpServletResponse) response;
        httpResponse.addHeader(ACCESS_CONTROL_ALLOW_ORIGIN, origin);
        httpResponse.addHeader(ACCESS_CONTROL_ALLOW_METHODS, fessConfig.getApiCorsAllowMethods());
        httpResponse.addHeader(ACCESS_CONTROL_ALLOW_HEADERS, fessConfig.getApiCorsAllowHeaders());

  public static final String ACCESS_CONTROL_ALLOW_METHODS = "Access-Control-Allow-Methods";

  /** The HTTP {@code Access-Control-Allow-Origin} header field name. */
  public static final String ACCESS_CONTROL_ALLOW_ORIGIN = "Access-Control-Allow-Origin";

  /**
   * The HTTP <a href="https://wicg.github.io/private-network-access/#headers">{@code
   * Access-Control-Allow-Private-Network}</a> header field name.
   *