Make cors middleware optional + tests

[yaron2]

This PR does the following:

1. Adds unit tests for the CORS middleware
2. Does not add the fasthttp handler middleware unless needed. Profiling has shown this code consumes a significant amount of memory under load (~1MB).

Release Note

RELEASE NOTE: Changed Cors middleware to optional + added tests

[codecov]

Codecov Report

Merging #2285 into master will increase coverage by 0.14%.
The diff coverage is 66.66%.

@@            Coverage Diff             @@
##           master    #2285      +/-   ##
==========================================
+ Coverage   48.08%   48.23%   +0.14%     
==========================================
  Files          70       70              
  Lines        6143     6145       +2     
==========================================
+ Hits         2954     2964      +10     
+ Misses       2931     2923       -8     
  Partials      258      258              

Impacted Files	Coverage Δ
pkg/runtime/cli.go	0.00% <0.00%> (ø)
pkg/runtime/config.go	100.00% <ø> (ø)
pkg/http/server.go	31.57% <100.00%> (+17.03%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 985a5bf...eeccb95. Read the comment docs.

[youngbupark]

is there a reason why we make cors middleware ? is this for testing?

[yaron2]

is there a reason why we make cors middleware ? is this for testing?

It's a feature we had from the very beginning, presumably to make sure that the Dapr API can only be accessed from certain origins. (helpful in the case where you expose the Dapr API publicly).

[youngbupark]

is there a reason why we make cors middleware ? is this for testing?

It's a feature we had from the very beginning, presumably to make sure that the Dapr API can only be accessed from certain origins. (helpful in the case where you expose the Dapr API publicly).

From the code I am reading, we only control Access-Control-Allow-Origin header for CORS set by cmd flag. no knobs for the other CORS headers such as Access-Control-Allow-Methods.

New cors package includes only one constant so I was wonder if we need this change.

Also do we plan to support the other CORS headers ?

[yaron2]

is there a reason why we make cors middleware ? is this for testing?

It's a feature we had from the very beginning, presumably to make sure that the Dapr API can only be accessed from certain origins. (helpful in the case where you expose the Dapr API publicly).

From the code I am reading, we only control Access-Control-Allow-Origin header for CORS set by cmd flag. no knobs for the other CORS headers such as Access-Control-Allow-Methods.

New cors package includes only one constant so I was wonder if we need this change.

Also do we plan to support the other CORS headers ?

The change just refactored the location of the const, didn't add a new one.

Also do we plan to support the other CORS headers ?

I don't know, maybe. we need to probably make CORS more visible to users and get feedback.