Improve CORS configuration

[qbert2k]

https://support.gluu.org/other/3630/insecure-response-with-wildcard-in-access-control-allow-origin/

[yurem]

We uses this proxy filter which supports both Tomcat/Jetty CORS filters

[yurem]

There is no these changes in 3.0.1 branch. We need to merge these changes into 3.0.2 branch

[yurem]

We need to add similar implementation to oxTrust too

[qbert2k]

Done for 3.0.2 as requested.

[aliaksander-samuseu]

Hi, @qbert2k

I see that we still use this "Access-Control-Allow-Origin: *" header in responses both in 3.0.x and 3.1.x packages. It happens because of this part of Apache's configuration:

        <Location /oxauth/seam/resource/restv1/oxauth/userinfo>
                ProxyPass http://localhost:8081/oxauth/seam/resource/restv1/oxauth/userinfo retry=5 disablereuse=On
                ProxyPassReverse http://localhost:8081/oxauth/seam/resource/restv1/oxauth/userinfo
                Header set Access-Control-Allow-Origin "*"
#                Header set Access-Control-Allow-Headers "Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization"
                Order allow,deny
                Allow from all
        </Location>

I.e. this header is simply attached to all responses from /oxauth/seam/resource/restv1/oxauth/userinfo.

We also have same line set for "/oxauth" path:

        <Location /oxauth>
                ProxyPass http://localhost:8081/oxauth retry=5 disablereuse=On
                ProxyPassReverse http://localhost:8081/oxauth
                Header set Access-Control-Allow-Origin "*"
                Order allow,deny
                Allow from all
        </Location>