User Story:

As a developer i want to get images and assets from magnolia demo project from other systems without any CORS problems so that I can test, demo, and evaluate full headless applications on Magnolia.

Acceptance Criteria

Requests for /.imaging/ and /dam/ urls will get all proper CORS headers.

Requests for /.rest/ will continue to get CORS headers.

Suggestion

Under the current /server/filters/addCORSHeaders/bypasses,

replace the "bypassForEverythingElseThanRest" with something like the following:

doNotBypassRestAndDamAndImaging 
class: info.magnolia.voting.voters.URIRegexVoter
not: true 
pattern: ^\/(\.imaging|\.rest|dam)\/(.*)

(Note: I tried this simpler way previously - but it does not seem to work because of the dots.)

doNotBypassRestAndDamAndImaging
  class: info.magnolia.voting.voters.URIPatternVoter
  not: true
  pattern: /(.rest|.imaging|dam)/*