[GitHub] brooklyn-server pull request #519: Add experimental CORS server support

[geomacy <gi...@git.apache.org>]

Github user geomacy commented on a diff in the pull request:

    https://github.com/apache/brooklyn-server/pull/519#discussion_r96459350
  
    --- Diff: core/src/main/java/org/apache/brooklyn/core/BrooklynFeatureEnablement.java ---
    @@ -61,6 +61,37 @@
         /** whether feeds are automatically registered when set on entities, so that they are persisted */
         public static final String FEATURE_FEED_REGISTRATION_PROPERTY = FEATURE_PROPERTY_PREFIX+".feedRegistration";
     
    +    /**
    --- End diff --
    
    I didn't say that CORS was _always_ insecure; used judiciously, it can be a perfectly acceptable mechanism for many use-cases.  Used badly or inappropriately, it can open you up to increased security risks, but the same can be said about lots of things.  I would remove the warnings from this comment, and simply explain what the feature is that is being enabled.  It is up to users to determine whether CORS is applicable in their case and to enable it if so.


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---