Allow cred/authorization header CORS

[fredx30]

• I've added a new note in the CHANGELOG.md file, according to docs:
  https://iver-wharf.github.io/#/development/changelogs/writing-changelogs

Summary

This adds a environment variable that allows setting a cors allowed origin. When this is set Authrization Bearer tokens will also be allowed to be sent. This overrides the allow all origins header. When sending credentials allow all origins is not allowed.

Motivation

When sending credentials allow all origins is not allowed. The way the OICD login is set to work credentials need to be sent and will use the authorization header.

[applejag]

I think this should be a slice of strings. While the header only can include 1 value, IIRC Gin will check the Origin header from the request and use the appropriate origin in the response header.

While we probably won't need more than 1, it's good to have the option available, especially since it's such an easy change but hard to change later as it changes the config schema.

Apparently Viper (that we're using for the configs) supports slices by separating elements via a comma.
(https://github.com/spf13/viper/blob/v1.7.1/viper.go#L920)

So you can change this to []string and then add something like this to the godoc:

Multiple origins can be supplied via environment variables by separating them by commas. YAML configuration is expected to use a regular array of strings.

[applejag]

nit: A rule of thumb I've used for logs is to not have anything varying in the message.

Suggest moving the config value here to a WithString call. For example:

Suggested change

	log.Info().Message("Allowing " + config.HTTP.CORS.AllowOrigins + " origins in CORS.")
	log.Info().WithString("origin", config.HTTP.CORS.AllowOrigins).
	Message("Allowing origins in CORS.")

But if you're changing to a string slice, then perhaps just something like this:

Suggested change

	log.Info().Message("Allowing " + config.HTTP.CORS.AllowOrigins + " origins in CORS.")
	log.Info().WithStringf("origin", "%v", config.HTTP.CORS.AllowOrigins).
	Message("Allowing origins in CORS.")

^ would resolve to something like origins=`[http://localhost:5001 http://localhost:4200]` in the console output for multiple values

Otherwise a more custom solution:

Suggested change

	log.Info().Message("Allowing " + config.HTTP.CORS.AllowOrigins + " origins in CORS.")
	log.Info().WithString("origin", strings.Join(config.HTTP.CORS.AllowOrigins, " ")).
	Message("Allowing origins in CORS.")

^ would resolve to something like origins=`http://localhost:5001 http://localhost:4200` in the console output for multiple values

[fredx30]

Sol 2 seems to work

[Alexamakans]

I agree that AllowOrigins should be []string, with updated godoc.
Prefer opt 2 for logging, resulting in origins=`[http://localhost:5001 http://localhost:4200]`

Will approve once AllowOrigins is changed to []string 👍🏻

[applejag]

LGTM!