pool: add CORS support for HTTP requests

Motivation:

Download and upload via HTTPS in dCacheView requires the pool to support
CORS.

Modification:

Add Netty built-in support for CORS.

Result:

dCacheView upload and download now succeeds.

Target: master
Request: 4.2
Requires-notes: yes
Requires-book: no
Patch: https://rb.dcache.org/r/11357/
Acked-by: Tigran Mkrtchyan

modules/dcache/src/main/java/org/dcache/http/HttpTransferService.java

@@ -22,6 +22,9 @@
 import io.netty.channel.ChannelPipeline;
 import io.netty.handler.codec.http.HttpRequestDecoder;
 import io.netty.handler.codec.http.HttpResponseEncoder;
+import io.netty.handler.codec.http.cors.CorsConfig;
+import io.netty.handler.codec.http.cors.CorsConfigBuilder;
+import io.netty.handler.codec.http.cors.CorsHandler;
 import io.netty.handler.logging.LoggingHandler;
 import io.netty.handler.stream.ChunkedWriteHandler;
 import io.netty.handler.timeout.IdleStateHandler;
@@ -46,6 +49,9 @@
 import org.dcache.pool.movers.NettyTransferService;
 import org.dcache.util.NetworkUtils;
 
+import static io.netty.handler.codec.http.HttpHeaderNames.*;
+import static io.netty.handler.codec.http.HttpMethod.*;
+
 /**
  * Netty-based HTTP transfer service.
  *
@@ -168,6 +174,14 @@ protected void addChannelHandlers(ChannelPipeline pipeline)
             pipeline.addLast("custom-headers", new CustomResponseHeadersHandler(customHeaders));
         }
 
+        CorsConfig corsConfig = CorsConfigBuilder.forAnyOrigin()
+                .allowNullOrigin()
+                .allowedRequestMethods(GET, PUT, HEAD)
+                .allowedRequestHeaders(CONTENT_TYPE, AUTHORIZATION, CONTENT_MD5,
+                        "Want-Digest", "suppress-www-authenticate")
+                .build();
+        pipeline.addLast("cors", new CorsHandler(corsConfig));
+
         pipeline.addLast("transfer", new HttpPoolRequestHandler(this, chunkSize));
     }
 }