### Question:
CorsUtil { public static String matchOrigin(HttpServerExchange exchange, Collection<String> allowedOrigins) throws Exception { HeaderMap headers = exchange.getRequestHeaders(); String[] origins = headers.get(Headers.ORIGIN).toArray(); if (allowedOrigins != null && !allowedOrigins.isEmpty()) { for (String allowedOrigin : allowedOrigins) { for (String origin : origins) { if (allowedOrigin.equalsIgnoreCase(sanitizeDefaultPort(origin))) { return allowedOrigin; } } } } String allowedOrigin = defaultOrigin(exchange); for (String origin : origins) { if (allowedOrigin.equalsIgnoreCase(sanitizeDefaultPort(origin))) { return allowedOrigin; } } ROOT_LOGGER.debug("Request rejected due to HOST/ORIGIN mis-match."); ResponseCodeHandler.HANDLE_403.handleRequest(exchange); return null; }  static boolean isCoreRequest(HeaderMap headers); static String matchOrigin(HttpServerExchange exchange, Collection<String> allowedOrigins); static String defaultOrigin(HttpServerExchange exchange); static String sanitizeDefaultPort(String url); static boolean isPreflightedRequest(HttpServerExchange exchange);  }### Answer:
@Test public void testMatchOrigin() throws Exception { HeaderMap headerMap = new HeaderMap(); headerMap.add(HOST, "localhost:80"); headerMap.add(ORIGIN, "http: HttpServerExchange exchange = new HttpServerExchange(null, headerMap, new HeaderMap(), 10); exchange.setRequestScheme("http"); Collection<String> allowedOrigins = null; assertThat(CorsUtil.matchOrigin(exchange, allowedOrigins), is("http: allowedOrigins = Collections.singletonList("http: assertThat(CorsUtil.matchOrigin(exchange, allowedOrigins), is("http: headerMap.clear(); headerMap.add(HOST, "localhost:80"); headerMap.add(ORIGIN, "http: assertThat(CorsUtil.matchOrigin(exchange, allowedOrigins), is("http: headerMap.clear(); headerMap.add(HOST, "localhost:80"); headerMap.add(ORIGIN, "http: assertThat(CorsUtil.matchOrigin(exchange, allowedOrigins), is(nullValue())); headerMap.addAll(ORIGIN, Arrays.asList("http: allowedOrigins = Arrays.asList("http: assertThat(CorsUtil.matchOrigin(exchange, allowedOrigins), is("http: }