4.x CORS configuration ignored for automatically-discovered Helidon-provided services (health, metrics)

[tjquinno]

Environment Details

• Helidon Version: 4.0.0
• Helidon SE or Helidon MP
• JDK version:
• OS:
• Docker version (if applicable):

---

Problem Description

The Helidon-provided services (OpenAPI, metrics, health...maybe new observers as well??) should--and are documented as--supporting CORS via configuration.

But seemingly the service-specific configuration is ignored.

This could be related to #8024 as opposed to something specific to the built-in services, but double-checking the built-in service support for CORS merits its own issue.

This could be a side-effect of converting metrics and health to observers that are discovered implicitly. In 3.x the doc showed how to construct the HealthSupport or MetricsSupport instance and also provide the CORS settings as the services were added to the routing.

Steps to reproduce

1. Start with the SE CORS example (because it already has the CORS-related dependencies).
2. Add the following to application.yaml (as described in our CORS documentation):

   health:
     cors:
       allow-origins: ["http://here.com"]
       allow-methods: ["GET", "HEAD"]
   

3. Build and start the server.
4. Run curl -i -H "Origin: http://bad.com" -H "Host: localhost:8080" http://localhost:8080/observe/health which should be rejected (bad.com is not one of the allowed origins) but the server returns the normal health response of 204.