/**
 * 獲取CorsConfiguration.
 */
@Override
protected CorsConfiguration getCorsConfiguration(Object handler, HttpServletRequest request) {
    // 若處理器為CorsConfigurationSource類型，直接獲取處理器CorsConfiguration配置.
    CorsConfiguration corsConfig = super.getCorsConfiguration(handler, request);
    if (handler instanceof HandlerMethod) {
        HandlerMethod handlerMethod = (HandlerMethod) handler;
        // 請(qǐng)求方法是預(yù)處理方法.
        if (handlerMethod.equals(PREFLIGHT_AMBIGUOUS_MATCH)) {
            return AbstractHandlerMethodMapping.ALLOW_CORS_CONFIG;
        }
        // 請(qǐng)求方法非預(yù)處理方法.
        else {
            // 根據(jù)處理器查找CorsConfiguration配置.
            CorsConfiguration corsConfigFromMethod = this.mappingRegistry.getCorsConfiguration(handlerMethod);
            // 合并corsConfig和corsConfigFromMethod.
            corsConfig = (corsConfig != null ? corsConfig.combine(corsConfigFromMethod) : corsConfigFromMethod);
        }
    }
    return corsConfig;
}

/**
 * 檢索給定處理程序的CORS配置.
 * @param handler 處理器.
 * @param request 當(dāng)前請(qǐng)求.
 * @return 處理程序的CORS配置，或者null（如果沒有）.
 */
@Nullable
protected CorsConfiguration getCorsConfiguration(Object handler, HttpServletRequest request) {
    Object resolvedHandler = handler;
    if (handler instanceof HandlerExecutionChain) {
        resolvedHandler = ((HandlerExecutionChain) handler).getHandler();
    }
    if (resolvedHandler instanceof CorsConfigurationSource) {
        return ((CorsConfigurationSource) resolvedHandler).getCorsConfiguration(request);
    }
    return null;
}

/**
 * 返回CORS配置.
 * 線程安全并發(fā)使用.
 */
public CorsConfiguration getCorsConfiguration(HandlerMethod handlerMethod) {
    // 解析實(shí)際的HandlerMethod.
    HandlerMethod original = handlerMethod.getResolvedFromHandlerMethod();
    // 從corsLookup中獲取CorsConfiguration配置.
    return this.corsLookup.get(original != null ? original : handlerMethod);
}

/**
 * 為CORS相關(guān)處理更新HandlerExecutionChain.
 * 對(duì)于預(yù)處理請(qǐng)求，默認(rèn)實(shí)現(xiàn)用一個(gè)簡單的HttpRequestHandler替換所選的處理程序，
 * 	該處理程序調(diào)用配置的setCorsProcessor.
 * 對(duì)于實(shí)際的請(qǐng)求，默認(rèn)實(shí)現(xiàn)插入一個(gè)HandlerInterceptor，它進(jìn)行CORS相關(guān)的檢查并添加CORS頭.
 * @param request 當(dāng)前請(qǐng)求.
 * @param chain 處理鏈.
 * @param config 適用的CORS配置（可能是null）.
 */
protected HandlerExecutionChain getCorsHandlerExecutionChain(HttpServletRequest request,
                                                             HandlerExecutionChain chain, @Nullable CorsConfiguration config) {
    // 是CORS預(yù)處理請(qǐng)求.
    if (CorsUtils.isPreFlightRequest(request)) {
        HandlerInterceptor[] interceptors = chain.getInterceptors();
        chain = new HandlerExecutionChain(new PreFlightHandler(config), interceptors);
    }
    // 不是CORS預(yù)處理請(qǐng)求.		
    else {
        chain.addInterceptor(new CorsInterceptor(config));
    }
    return chain;
}

/**
 * 處理請(qǐng)求.
 */
@Override
@SuppressWarnings("resource")
public boolean processRequest(@Nullable CorsConfiguration config, HttpServletRequest request,
                              HttpServletResponse response) throws IOException {
    // 非CORS請(qǐng)求，不進(jìn)行處理.
    if (!CorsUtils.isCorsRequest(request)) {
        return true;
    }
    // 響應(yīng)已包含Access-Control-Allow-Origin，不進(jìn)行處理.
    ServletServerHttpResponse serverResponse = new ServletServerHttpResponse(response);
    if (responseHasCors(serverResponse)) {
        logger.debug("Skip CORS processing: response already contains \"Access-Control-Allow-Origin\" header");
        return true;
    }
    // 請(qǐng)求來自同源，不進(jìn)行處理.
    ServletServerHttpRequest serverRequest = new ServletServerHttpRequest(request);
    if (WebUtils.isSameOrigin(serverRequest)) {
        logger.debug("Skip CORS processing: request is from same origin");
        return true;
    }
    // 是否預(yù)處理請(qǐng)求.
    boolean preFlightRequest = CorsUtils.isPreFlightRequest(request);
    if (config == null) {
        if (preFlightRequest) {
            rejectRequest(serverResponse);
            return false;
        }
        else {
            return true;
        }
    }
	// 請(qǐng)求處理方法.
    return handleInternal(serverRequest, serverResponse, config, preFlightRequest);
}

/**
 * 請(qǐng)求處理方法.
 */
protected boolean handleInternal(ServerHttpRequest request, ServerHttpResponse response,
                                 CorsConfiguration config, boolean preFlightRequest) throws IOException {
    // 獲取請(qǐng)求的Origin頭.
    String requestOrigin = request.getHeaders().getOrigin();
    // 檢查并獲取允許源.
    String allowOrigin = checkOrigin(config, requestOrigin);
    HttpHeaders responseHeaders = response.getHeaders();
    // 增加Vary頭，其值為：Origin、Access-Control-Request-Method、Access-Control-Request-Headers.
    responseHeaders.addAll(HttpHeaders.VARY, Arrays.asList(HttpHeaders.ORIGIN,
                                                           HttpHeaders.ACCESS_CONTROL_REQUEST_METHOD, HttpHeaders.ACCESS_CONTROL_REQUEST_HEADERS));
    // 允許源為空，則拒絕請(qǐng)求.
    if (allowOrigin == null) {
        logger.debug("Rejecting CORS request because '" + requestOrigin + "' origin is not allowed");
        rejectRequest(response);
        return false;
    }
    // 獲取請(qǐng)求方法.
    HttpMethod requestMethod = getMethodToUse(request, preFlightRequest);
    // 檢查并獲取允許的方法.
    List<HttpMethod> allowMethods = checkMethods(config, requestMethod);
    // 允許方法為空，則拒絕請(qǐng)求.
    if (allowMethods == null) {
        logger.debug("Rejecting CORS request because '" + requestMethod + "' request method is not allowed");
        rejectRequest(response);
        return false;
    }
    // 獲取請(qǐng)求頭.
    List<String> requestHeaders = getHeadersToUse(request, preFlightRequest);
    // 檢查并獲取請(qǐng)求的頭.
    List<String> allowHeaders = checkHeaders(config, requestHeaders);
    // 預(yù)處理請(qǐng)求，且允許的頭為空，拒絕請(qǐng)求.
    if (preFlightRequest && allowHeaders == null) {
        logger.debug("Rejecting CORS request because '" + requestHeaders + "' request headers are not allowed");
        rejectRequest(response);
        return false;
    }
    // 設(shè)置允許的源.
    responseHeaders.setAccessControlAllowOrigin(allowOrigin);
    // 設(shè)置Access-Control-Allow-Methods.
    if (preFlightRequest) {
        responseHeaders.setAccessControlAllowMethods(allowMethods);
    }
    // 設(shè)置Access-Control-Allow-Headers.
    if (preFlightRequest && !allowHeaders.isEmpty()) {
        responseHeaders.setAccessControlAllowHeaders(allowHeaders);
    }
    // 設(shè)置Access-Control-Expose-Headers.
    if (!CollectionUtils.isEmpty(config.getExposedHeaders())) {
        responseHeaders.setAccessControlExposeHeaders(config.getExposedHeaders());
    }
    // 設(shè)置Access-Control-Allow-Credentials.
    if (Boolean.TRUE.equals(config.getAllowCredentials())) {
        responseHeaders.setAccessControlAllowCredentials(true);
    }
    // 設(shè)置Access-Control-Max-Age.
    if (preFlightRequest && config.getMaxAge() != null) {
        responseHeaders.setAccessControlMaxAge(config.getMaxAge());
    }
    response.flush();
    return true;
}