///////////////////////////////////////////////////////////////////////////////

    Copyright (c) 2020 Oracle and/or its affiliates.

    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at

        http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.

///////////////////////////////////////////////////////////////////////////////

= Using CORS in Built-in Services
:toc:
:toc-placement: preamble
:h1Prefix: SE
:pagename: cors-built-in-service-support
:description: Helidon SE CORS Support in Built-in Services
:keywords: helidon, java, cors, se, services
:helidon-tag: https://github.com/oracle/helidon/tree/{helidon-version}
:quickstart-example: {helidon-tag}/examples/quickstarts/helidon-quickstart-se
:cors-spec: https://www.w3.org/TR/cors/
:helidon-se-cors-example: {helidon-tag}/examples/cors
:helidon-tag: https://github.com/oracle/helidon/tree/{helidon-version}
:quickstart-example: {helidon-tag}/examples/quickstarts/helidon-quickstart-se
:javadoc-base-url-api: {javadoc-base-url}io.helidon.webserver.cors/io/helidon/webserver/cors
:javadoc-base-url-webserver: {javadoc-base-url}io.helidon.webserver/io/helidon/webserver
:cors-se-api-doc: ../../se/cors/02_using-the-api.adoc
:cors-config-table-src: {cors-se-api-doc}
:cors-dependency-src: {cors-se-api-doc}
:actual-cors-dependency-src: {cors-se-api-doc}
:health-page: se/health/01_health.adoc
:metrics-page: se/metrics/01_metrics.adoc
:openapi-page: se/openapi/01_openapi.adoc
:cors-config: ../../se/cors/03_using-configuration.adoc
:cors-services-is-se:
:helidon-variant: SE
:common-page-prefix-inc: ../../shared/cors/common_shared.adoc

Several built-in Helidon services -- health, metrics, and OpenAPI -- have integrated CORS support.
You can include these services in your application and control their CORS behavior.


include::{common-page-prefix-inc}[tag=understanding-cors-support-in-services]

include::{common-page-prefix-inc}[tag=builtin-getting-started]

== Controlling CORS for Built-in Services Using the API
Although services such as health, metrics, and OpenAPI are built into Helidon, to use them your application must create
instances of the services and then use those instances in building your application's routing rules.

Recall that each
service type has a `Builder` class. To control the CORS behavior of a built-in service using the API, follow these steps:

. Create a `Builder` for the type of service of interest.

. Build an instance of `CrossOriginConfig` with the settings you want.

. Invoke the `builder.crossOriginConfig` method, passing that `CrossOriginConfig` instance.

. Invoke the builder's `build` method to initialize the service instance.

. Use the service instance in preparing the routing rules.

The following excerpt shows changes to the link:{quickstart-example}[Helidon SE QuickStart example] which limit
sharing of the `/metrics` endpoint to `\http://foo.com`.
[source,java]
----
private static Routing createRouting(Config config) {

        CrossOriginConfig metricsCrossOriginConfig = CrossOriginConfig.builder() // <1>
                .allowOrigins("http://foo.com")
                .build();
        MetricsSupport metrics = MetricsSupport.builder()
                .crossOriginConfig(metricsCrossOriginConfig) // <2>
                .build();
        GreetService greetService = new GreetService(config);
        HealthSupport health = HealthSupport.builder()
                .addLiveness(HealthChecks.healthChecks())   // Adds a convenient set of checks
                .build();

        return Routing.builder()
                .register(health)                   // Health at "/health"
                .register(metrics)                  // Metrics at "/metrics" // <3>
                .register("/greet", greetService)
                .build();
    }
----
<1> Create the `CrossOriginConfig` for metrics, limiting sharing to `\http://foo.com`.
<2> Use the `CrossOriginConfig` instance in constructing the `MetricsSupport` service.
<3> Use the `MetricsSupport` object in creating the routing rules.

include::{common-page-prefix-inc}[tag=configuring-cors-for-builtin-services]

include::{common-page-prefix-inc}[tag=accessing-shared-resources-intro]

[source,bash]
----
mvn package
java -jar target/helidon-quickstart-se.jar
...
WEB server is up! http://localhost:8080/greet
----

include::{common-page-prefix-inc}[tag=accessing-shared-resources-main]
