Remove settings of CORS heads in the options block. (#1681)

Author: MikeNeilson

cwms-data-api/src/main/java/cwms/cda/ApiServlet.java

@@ -410,10 +410,10 @@ public void init() {
                 })
                 .routes(this::configureRoutes)
                 .options("/*", ctx -> {
-                    ctx.header("Access-Control-Allow-Origin", "*"); // Allow requests from any origin
-                    ctx.header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS"); // Specify allowed methods
-                    ctx.header("Access-Control-Allow-Headers", "Content-Type, Authorization"); // Specify allowed headers
-                    ctx.status(200); // Respond with a 200 OK status
+                    // Respond with a 200 OK status for preflight checks.
+                    // It is expected that the firewall in front of the API
+                    // will handle any CORS headers.
+                    ctx.status(200);
                 })
                 .javalinServlet();
         QueueManager.ensureRssSubscribers(cwms);

cwms-data-api/src/test/java/cwms/cda/api/BaseLineTestIT.java

@@ -34,9 +34,7 @@ void test_options_handling_known_url(String url) throws Exception {
         .then()
             .log().ifValidationFails(LogDetail.ALL,true)
             .assertThat()
-            .statusCode(is(HttpServletResponse.SC_OK))
-            .header("Access-Control-Allow-Methods", equalTo("GET, POST, PUT, DELETE, OPTIONS"))
-            .header("Access-Control-Allow-Headers", equalTo("Content-Type, Authorization"));
+            .statusCode(is(HttpServletResponse.SC_OK));
     }
 
     @ParameterizedTest
@@ -51,8 +49,6 @@ void test_options_handling_unknown_url(String url) throws Exception {
         .then()
             .log().ifValidationFails(LogDetail.ALL,true)
             .assertThat()
-            .statusCode(is(HttpServletResponse.SC_OK))
-            .header("Access-Control-Allow-Methods", nullValue())
-            .header("Access-Control-Allow-Headers", nullValue());
+            .statusCode(is(HttpServletResponse.SC_OK));
     }
 }