Provide CORS headers configuration for /openapi endpoint

[lreimer]

Provide CORS Headers configuration for /openapi endpoint

---

Currently, there does not seem to be a way to configure and send proper CORS headers for the /openapi endpoint. According to the Microprofile OpenAPI Spec CORS headers are implementation dependent, but I think this would be a sensible enhancement, so that the API spec can be used and displayed by third party tools like the Swagger UI.

Expected Outcome

I can configure the Microprofile OpenAPI endpoint to emits CORS headers so that the documentation can be used e.g. in the Swagger UI.

Current Outcome

Currently, no CORS headers are added to the /openapi HTTP response. Swagger UI is complaining.

Steps to reproduce (Only for bug reports)

Fire up swagger UI (e.g. using current Docker image) and point it to a /openapi endpoint.

docker run -p 80:8080 -e API_URL=http://localhost:8080/openapi/ swaggerapi/swagger-ui:v3.20.9

Samples

Context (Optional)

We are currently looking into providing an API catalog for developers for all our Payara based microservices. Proper CORS headers would make this easier. Currently, we have a separate NGINX that adds these headers for us.

Environment

• Payara Version: 5.184
• Edition: Micro
• JDK Version: Zulu 8u202
• Operating System: CentOS Docker Image

[smillidge]

I assume this should be configurable?

[lreimer]

I guess make them configurable is the most flexible. Always applying CORS headers per default may be a security issue. What's your opinion on this?

[lreimer]

Either make these configurable via microprofile-config.properties or maybe via the set-openapi-configuration asadmin command?

[lreimer]

I had quick look at the current implementation. Here is what I would do:

• extend OpenApiServiceConfiguration and add an additional config property cors-enabled
• implement a simple JAX-RS container response filter to add CORS headers. Only add the headers if the configuration property is enabled.
• register filter in the OpenApiApplication

Would you accept a pull request for this?

[smillidge]

Closed by #3793