CorsFilter in doFilter method get allowed origins based on request and set them in AbstractCorsFilter.allowedOrigins before calling AbstractCorsFilter.doFilter. This is bad idea to pass them in such way because WebFilter is defined with asyncSupported = true. Hence second request can override this variable value. We can use:
request.setAttribute("clientAllowedOrigins", clientAllowedOrigins);
to pass client allowed origins to AbstractCorsFilter.doFilter
CorsFilter in doFilter method get allowed origins based on request and set them in
AbstractCorsFilter.allowedOriginsbefore callingAbstractCorsFilter.doFilter. This is bad idea to pass them in such way because WebFilter is defined withasyncSupported = true. Hence second request can override this variable value. We can use:to pass client allowed origins to
AbstractCorsFilter.doFilter