CORS configurations for score server allowing multiple origins

score-server/src/main/java/bio/overture/score/server/ServerMain.java

@@ -1,12 +1,16 @@
 package bio.overture.score.server;
 
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.actuate.autoconfigure.security.servlet.ManagementWebSecurityAutoConfiguration;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 import org.springframework.boot.autoconfigure.jdbc.DataSourceAutoConfiguration;
 import org.springframework.boot.autoconfigure.jdbc.DataSourceTransactionManagerAutoConfiguration;
 import org.springframework.boot.autoconfigure.orm.jpa.HibernateJpaAutoConfiguration;
 import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
+import org.springframework.context.annotation.Bean;
+import org.springframework.web.servlet.config.annotation.CorsRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 
 /**
  * Application entry point.
@@ -20,8 +24,22 @@
 })
 public class ServerMain {
 
+  @Value("${management.endpoints.web.cors.allowedOrigins}")
+  private String[] allowedOrigins;
+
   public static void main(String... args) {
     SpringApplication.run(ServerMain.class, args);
   }
 
+  @Bean
+  public WebMvcConfigurer corsConfigurer() {
+    return new WebMvcConfigurer() {
+      @Override
+      public void addCorsMappings(CorsRegistry registry) {
+        registry.addMapping("/**")
+                .allowedOrigins(allowedOrigins)
+                .allowedMethods("PUT", "DELETE", "GET", "POST");
+      }
+    };
+  }
 }

score-server/src/main/resources/application.yml

@@ -82,6 +82,13 @@ auth:
     # E.g. TIMEOUT(n) = TIMEOUT(n-1) * MULTIPLIER
     multiplier: 2.0
 
+#allowedOrigins can be configured to contain multiple values, all separated by commas
+management:
+  endpoints:
+    web:
+      cors:
+        allowedOrigins: http://localhost:8081
+
 ---
 
 ###############################################################################