abandon the dynamic reflection of the client's Origin header

Author: jhua-vmware

g11n-ws/vip-manager-i18n/src/main/java/com/vmware/vip/core/Interceptor/APICrossDomainInterceptor.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2023 VMware, Inc.
+ * Copyright 2019-2026 VMware, Inc.
  * SPDX-License-Identifier: EPL-2.0
  */
 package com.vmware.vip.core.Interceptor;
@@ -30,8 +30,13 @@ public APICrossDomainInterceptor(Set<String> allowOrigin, String allowHeaders, S
 	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
 			throws Exception {
 		String originHeader = request.getHeader("Origin");
-		if (allowOrigin.contains("*") || allowOrigin.contains(originHeader)) {
-			response.setHeader("Access-Control-Allow-Origin", originHeader == null ? "" : originHeader);
+		if (allowOrigin.contains("*")) {
+			response.setHeader("Access-Control-Allow-Origin", "*");
+			response.setHeader("Access-Control-Allow-Methods", allowMethods);
+			response.setHeader("Access-Control-Allow-Headers", allowHeaders);
+			response.setHeader("Access-Control-Max-Age", maxAge);
+		} else if (allowOrigin.contains(originHeader)) {
+			response.setHeader("Access-Control-Allow-Origin", originHeader);
 			response.setHeader("Access-Control-Allow-Methods", allowMethods);
 			response.setHeader("Access-Control-Allow-Headers", allowHeaders);
 			response.setHeader("Access-Control-Allow-Credentials", allowCredentials);

g11n-ws/vip-manager-i18n/src/main/resources/application-bundle.properties

@@ -1,5 +1,5 @@
 ##
-#Copyright 2019-2022 VMware, Inc.
+#Copyright 2019-2026 VMware, Inc.
 #SPDX-License-Identifier: EPL-2.0
 ##
 
@@ -71,7 +71,7 @@ vipservice.authority.ldap.searchbase=###
 
 #cross-domain configuration
 vipservice.cross.domain.enable=true
-vipservice.cross.domain.allowCredentials=true
+vipservice.cross.domain.allowCredentials=false
 vipservice.cross.domain.alloworigin=*
 vipservice.cross.domain.allowmethods=GET, POST, PUT, DELETE, OPTIONS
 vipservice.cross.domain.allowheaders=csp-auth-token, Content-Type, x-xmp-ui, Authorization

g11n-ws/vip-manager-i18n/src/main/resources/application-gcs.properties

@@ -1,5 +1,5 @@
 ##
-#Copyright 2019-2022 VMware, Inc.
+#Copyright 2019-2026 VMware, Inc.
 #SPDX-License-Identifier: EPL-2.0
 ##
 
@@ -69,7 +69,7 @@ vipservice.authority.ldap.searchbase=####
 
 #cross-domain configuration
 vipservice.cross.domain.enable=true
-vipservice.cross.domain.allowCredentials=true
+vipservice.cross.domain.allowCredentials=false
 vipservice.cross.domain.alloworigin=*
 vipservice.cross.domain.allowmethods=GET, POST, PUT, DELETE, OPTIONS
 vipservice.cross.domain.allowheaders=csp-auth-token, Content-Type, x-xmp-ui, Authorization

g11n-ws/vip-manager-i18n/src/main/resources/application-s3.properties

@@ -1,5 +1,5 @@
 ##
-#Copyright 2019-2022 VMware, Inc.
+#Copyright 2019-2026 VMware, Inc.
 #SPDX-License-Identifier: EPL-2.0
 ##
 
@@ -76,7 +76,7 @@ vipservice.authority.ldap.searchbase=####
 
 #cross-domain configuration
 vipservice.cross.domain.enable=true
-vipservice.cross.domain.allowCredentials=true
+vipservice.cross.domain.allowCredentials=false
 vipservice.cross.domain.alloworigin=*
 vipservice.cross.domain.allowmethods=GET, POST, PUT, DELETE, OPTIONS
 vipservice.cross.domain.allowheaders=csp-auth-token, Content-Type, x-xmp-ui, Authorization