SITES-8366 - [wknd.site] Update CORS configuration to support multiple origins

raducotescu commented 1 year ago

Description

This PR moves all publish-tier CORS configuration in the dispatcher, since that's the only layer that can correctly apply Vary based caching.

The dispatcher change configuration has been tested using the Dispatcher SDK.

[ ] Bug fix (non-breaking change which fixes an issue)
[x] New feature (non-breaking change which adds functionality)
[ ] Breaking change (fix or feature that would cause existing functionality to change)

[x] I have signed the Adobe Open Source CLA.
[x] My code follows the code style of this project.
[ ] My change requires a change to the documentation.
[ ] I have updated the documentation accordingly.
[x] I have read the CONTRIBUTING document.
[ ] I have added tests to cover my changes.
[x] All new and existing tests passed (there are no specific dispatcher/CORS tests)

raducotescu commented 1 year ago

For 1. I guess we could add a publish config that's only active on development environments - we should probably add a new dev runmode for that.

For 2. we could wrap these configs inside a Location or LocationMatch directive.

davidjgonzalez commented 1 year ago

@raducotescu

How would we distinguish between AEM SDK dev and AEM as a Cloud service dev? Would a OSGi config on AEM as a Cloud Service Dev be problematic? Or will the httpd config overrwrite any headers that might generate?
IMO, Less is more. If its OK not to add this extra concern, that's simpler from a user POV. If we need to add it from a security POV, then i guess we have to. I was just raising the question to make sure we didn't miss something; ill leave it to yall to determine if its best practice/required.

davidjgonzalez commented 1 year ago

Converting to Draft as this depends on AEM CS release (which contains updates to Dispatcher).