@Override
	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
		// For PUT requests we need an extra round-trip
		// See e.g. http://www.html5rocks.com/en/tutorials/cors/

		String acRequestMethod = request.getHeader(ACCESS_CONTROL_REQUEST_METHOD);
		String acRequestHeaders = request.getHeader(ACCESS_CONTROL_REQUEST_HEADERS);

		response.setHeader(ACCESS_CONTROL_ALLOW_ORIGIN, allowedOrigin);

		if (HttpMethod.OPTIONS.toString().equals(request.getMethod()) && hasValue(acRequestMethod)) {
			// this is a preflight check our API only needs this for PUT
			// requests, anything we can PUT we can also GET
			response.addHeader(ACCESS_CONTROL_ALLOW_METHODS, HttpMethod.GET.toString());
			response.addHeader(ACCESS_CONTROL_ALLOW_METHODS, HttpMethod.POST.toString());
			response.addHeader(ACCESS_CONTROL_ALLOW_METHODS, HttpMethod.PUT.toString());
			response.addHeader(ACCESS_CONTROL_ALLOW_METHODS, HttpMethod.DELETE.toString());
			response.setHeader(ACCESS_CONTROL_ALLOW_HEADERS, acRequestHeaders);
			response.setHeader(ACCESS_CONTROL_MAX_AGE, CACHE_SECONDS);

			return false; // Don't continue processing, return to browser immediately
		}
		else {
			response.addHeader(ACCESS_CONTROL_EXPOSE_HEADERS, LOCATION);
		}

		return true; // Not a preflight check, continue as normal
	}
An interceptor to handle basic CORS logic.

@author Eric Bottard
spring-xd-dirt/src/main/java/org/springframework/xd/dirt/rest/AccessControlInterceptor.java