final String origin = httpRequest.getHeader("Origin");
        if (StringUtil.isNotBlank(origin)) {
            if (logger.isDebugEnabled()) {
                logger.debug("HTTP Request: {}", httpRequest.getMethod());
            }
            final CorsHandlerFactory factory = ComponentUtil.getCorsHandlerFactory();
            final CorsHandler handler = factory.get(origin);
            if (handler != null) {

package org.codelibs.fess.cors;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

public abstract class CorsHandler {

    protected static final String ACCESS_CONTROL_ALLOW_ORIGIN = "Access-Control-Allow-Origin";

    protected static final String ACCESS_CONTROL_ALLOW_HEADERS = "Access-Control-Allow-Headers";

    protected static final String ACCESS_CONTROL_ALLOW_METHODS = "Access-Control-Allow-Methods";

    String API_CORS_ALLOW_ORIGIN = "api.cors.allow.origin";

    /** The key of the configuration. e.g. GET, POST, OPTIONS, DELETE, PUT */
    String API_CORS_ALLOW_METHODS = "api.cors.allow.methods";

    /** The key of the configuration. e.g. 3600 */
    String API_CORS_MAX_AGE = "api.cors.max.age";

    /** The key of the configuration. e.g. Origin, Content-Type, Accept, Authorization, X-Requested-With */

    }

    @Override
    public void process(final String origin, final ServletRequest request, final ServletResponse response) {
        final FessConfig fessConfig = ComponentUtil.getFessConfig();
        final HttpServletResponse httpResponse = (HttpServletResponse) response;
        httpResponse.addHeader(ACCESS_CONTROL_ALLOW_ORIGIN, origin);

        List<String> list = (List<String>) propMap.get(CORS_ALLOW_ORIGIN);
        if (list == null) {
            list = split(getApiCorsAllowOrigin(), "\n")
                    .get(stream -> stream.map(String::trim).filter(StringUtil::isNotEmpty).collect(Collectors.toList()));
            propMap.put(CORS_ALLOW_ORIGIN, list);
        }
        return list;
    }

	"http://dbflute.org/meta/lastadi10.dtd">
<components>
	<component name="searchEngineClient" class="org.codelibs.fess.es.client.SearchEngineClient">
		<property name="settings">
			{"http.cors.enabled":"true",
			 "http.cors.allow-origin":"*",
			 "discovery.type":"single-node",
			 <!--
			 "node.name":"search_engine",
			 "discovery.seed_hosts":"search_engine",
			 "cluster.initial_cluster_manager_nodes":"search_engine",

    public void add(final String origin, final CorsHandler handler) {
        if (logger.isDebugEnabled()) {
            logger.debug("Loaded {}", origin);
        }
        handerMap.put(origin, handler);
    }

    public CorsHandler get(final String origin) {
        final CorsHandler handler = handerMap.get(origin);
        if (handler != null) {
            return handler;
        }

    //                                                                            ========
    /**
     * {@inheritDoc} <br>
     * Application Origin Methods:
     * <pre>
     * <span style="font-size: 130%; color: #553000">[Small Helper]</span>
     * o saveInfo() <span style="color: #3F7E5E">// save messages to session</span>

api.json.response.exception.included=false
api.gsa.response.headers=
api.gsa.response.exception.included=false
api.dashboard.response.headers=
api.cors.allow.origin=*
api.cors.allow.methods=GET, POST, OPTIONS, DELETE, PUT
api.cors.max.age=3600
api.cors.allow.headers=Origin, Content-Type, Accept, Authorization, X-Requested-With
api.cors.allow.credentials=true
api.jsonp.enabled=false
api.ping.search_engine.fields=status,timed_out

                SID.resolveSids(server, auth, sids, off, len);
            }
        } else {
            for (ai = 0; ai < aces.length; ai++) {
                aces[ai].sid.origin_server = server;
                aces[ai].sid.origin_auth = auth;
            }
        }
    }
/**
 * Return an array of Access Control Entry (ACE) objects representing