CorsService's `Access-Control-Allow-Headers` wildcard compatibility

Users may configure Access-Control-Allow-Headers using CorsServiceBuilder#allowRequestHeaders and set allowRequestHeaders as wildcard (*) to allow all headers.

However, it has compatibility issue because Internet Explorer, Safari and Firefox for Android don’t support:

So I guess that CorsService doesn’t support allowing all headers. And it would be fixed by returning requested Access-Control-Request-Headers header and providing an option:

allowAllRequestHeaders() {
  allowAllRequestHeaders(false);
}

allowAllRequestHeaders(boolean useWildcard) {
  ...
}

[minwoox]

@minwoox wanted to override additional restrictions

That’s not what I wanted. I just didn’t know about those headers could be ommited.

Even application/json is not allowed if Content-Type is not specified in the allowed header.

That’s true. In this case, the browser will set the Content-Type to Access-Control-Request-Headers and the response should contain Content-Type in Access-Control-Allow-Headers which means Content-Type needs to be set via CorsServiceBuilder#allowRequestHeaders.

[ks-yim]

I thought @minwoox wanted to override additional restrictions 😄. Even application/json is not allowed if Content-Type is not specified in the allowed header.

Either way is fine for me, though.