I’m not sure who is working on the GeoServer 3 sprint, but I wanted to give a heads up that the version of Jetty (12.0.28) is no longer compatible with GeoServer’s web.xml CORS configuration. It looks like the CrossOriginFilter was removed for 12+. It doesn’t look like they plan on supporting a web.xml configuration at all going forward.
My current hacky workaround is to add the edit below to Start.java but I think we probably want a solution that is configurable in the web administration interface?
WebAppContext wah = new WebAppContext();
wah.setContextPath("/geoserver");
wah.setWar("src/main/webapp");
CrossOriginHandler corsHandler = new CrossOriginHandler();
corsHandler.setAllowedOriginPatterns(Set.of("*"));
corsHandler.setAllowedMethods(Set.of("GET", "POST", "HEAD", "OPTIONS"));
corsHandler.setAllowedHeaders(Set.of("X-Requested-With", "Content-Type", "Accept", "Origin"));
Handler.Sequence rootHandlers = new Handler.Sequence();
rootHandlers.addHandler(corsHandler);
rootHandlers.addHandler(wah);
jettyServer.setHandler(rootHandlers);