@Test
public void testCorsHeaderAddedToAllowedHostOnly() throws IOException, ServletException {

    HttpServletRequest httpServletRequest = mock(HttpServletRequest.class);
    HttpServletResponse httpServletResponse = spy(new MockHttpServletResponse());
    FilterChain filterChain = mock(FilterChain.class);
    CORSResponseFilter filter = buildFilter("www.geonetwork-opensource.org,osgeo.org");
    when(httpServletRequest.getHeader("origin")).thenReturn("http://www.geonetwork-opensource.org");
    filter.doFilter(httpServletRequest, httpServletResponse, filterChain);
    assertEquals("*", httpServletResponse.getHeader("Access-Control-Allow-Origin"));
    httpServletResponse = spy(new MockHttpServletResponse());
    when(httpServletRequest.getHeader("origin")).thenReturn("http://osgeo.org");
    filter.doFilter(httpServletRequest, httpServletResponse, filterChain);
    assertEquals("*", httpServletResponse.getHeader("Access-Control-Allow-Origin"));
    httpServletResponse = spy(new MockHttpServletResponse());
    when(httpServletRequest.getHeader("origin")).thenReturn("http://www.dummy.org");
    filter.doFilter(httpServletRequest, httpServletResponse, filterChain);
    assertNull(httpServletResponse.getHeader("Access-Control-Allow-Origin"));
}