以下の引数がサポートされています:

* `allow_origins` - オリジン間リクエストを許可するオリジンのリスト。例えば、`['https://example.org', 'https://www.example.org']`。`['*']`を使用して任意のオリジンを許可できます。
* `allow_origin_regex` - オリジン間リクエストを許可するオリジンの正規表現文字列。例えば、`'https://.*\.example\.org'`。
* `allow_methods` - オリジン間リクエストで許可するHTTPメソッドのリスト。デフォルトは `['GET']` です。`['*']`を使用してすべての標準メソッドを許可できます。

        for (int i = 0; i < 5; i++) {
            final Map<String, Object> doc = new HashMap<>();
            doc.put("title", NAME_PREFIX + i);
            doc.put("url", "http://example.com/bulk/" + i);
            doc.put("content", "This is test content for bulk document " + i);
            doc.put("boost", 1.0f);
            doc.put("role", "Rguest");
            documents.add(doc);
        }

 * code point. An additional safe range is provided that determines whether code points without
 * specific replacements are to be considered safe and left unescaped or should be escaped in a
 * general way.
 *
 * <p>A good example of usage of this class is for HTML escaping where the replacement array
 * contains information about the named HTML entities such as {@code &amp;} and {@code &quot;} while

   * value. Otherwise, a call that passes one {@code loader} may return the result of another call
   * with a differently behaving {@code loader}. For example, a call that requests a short timeout
   * for an RPC may wait for a similar call that requests a long timeout, or a call by an
   * unprivileged user may return a resource accessible only to a privileged user making a similar

		serverAddr  string
		expectedErr error
	}{
		{":54321", nil},
		{"localhost:54321", nil},
		{"0.0.0.0:9000", nil},
		{":0", nil},
		{"localhost", nil},
		{"", fmt.Errorf("invalid argument")},
		{"example.org:54321", fmt.Errorf("host in server address should be this server")},
		{":-10", fmt.Errorf("port must be between 0 to 65535")},
	}

	for _, testCase := range testCases {
		t.Run("", func(t *testing.T) {

* You can ask them to provide a [minimal, reproducible, example](https://stackoverflow.com/help/minimal-reproducible-example), that you can **copy-paste** and run locally to see the same error or behavior they are seeing, or to understand their use case better.

- 沒有 `Content-Type` 標頭（例如以 `fetch()` 並使用 `Blob` 作為 body）
- 且沒有送出任何身分驗證憑證

這種攻擊主要與以下情境相關：

- 應用在本機（例如 `localhost`）或內部網路中執行
- 並且應用沒有任何身分驗證，假設同一個網路中的任何請求都可被信任

## 攻擊範例 { #example-attack }

假設你打造了一個在本機執行 AI 代理（AI agent）的方法。

它提供一個 API：

```
http://localhost:8000/v1/agents/multivac
```

同時也有一個前端：

```
http://localhost:8000
```

/// tip | 提示

   * Inet4Address} objects, not {@link Inet6Address}. This is consistent with the behavior of {@link
   * InetAddress}.
   *
   * <p>This method accepts non-ASCII digits, for example {@code "１９２.１６８.０.１"} (those are fullwidth
   * characters). That is consistent with {@link InetAddress}, but not with various RFCs. If you
   * want to accept ASCII digits only, you can use something like {@code

 * <p>
 * Implementations of this interface will be discovered through the Java ServiceLoader mechanism
 * and their provided lifecycles will be available throughout the Maven build process.
 * <p>
 * Example usage:
 * <pre>
 * public class CustomLifecycleProvider implements LifecycleProvider {
 *     public Collection&lt;Lifecycle&gt; provides() {
 *         return Collections.singleton(

 * <p>
 * Implementations of this interface will be discovered through the Java ServiceLoader mechanism
 * and their provided path scopes will be available throughout the Maven build process.
 * <p>
 * Example usage:
 * <pre>
 * public class CustomPathScopeProvider implements PathScopeProvider {
 *     public Collection&lt;PathScope&gt; provides() {
 *         return Collections.singleton(pathScope("integration-test",