code: @Override
      public ContainerResponse filter(ContainerRequest cres, ContainerResponse response) {
          initLazily(servletRequest);
          String requestOrigin = cres.getHeaderValue("Origin");
          if (requestOrigin != null) { // is this is a cors request (ajax request that targets a different domain than the one the page was loaded from)
              if (allowedOrigin != null && allowedOrigin.startsWith(requestOrigin)) {  // no cors allowances make are applied if allowedOrigins == null
                  // only return the origin the client informed
                  response.getHttpHeaders().add("Access-Control-Allow-Origin", requestOrigin);
                  response.getHttpHeaders().add("Access-Control-Allow-Headers", "origin, content-type, accept, authorization");
                  response.getHttpHeaders().add("Access-Control-Allow-Credentials", "true");
                  response.getHttpHeaders().add("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS, HEAD");
                  response.getHttpHeaders().add("Access-Control-Max-Age", "1209600");
              }
          }
          return response;
      }
docs: We return Access-* headers only in case allowedOrigin is present and equals to the 'Origin' header.