It is currently a finicky and error-prone step to enable a basic CORS configuration such that a developer can access Magnolia REST endpoints. It can be done with a Java install task, but this is not available in Light Development. Even with the 'content-importer' no ordering of nodes is possible.
The reason it is tricky because it is a filter configuration which must be put into a specfic location in the chain (as specified in documentation).

To solve this we could provide a default CORS configuration in the filter chain, positioned in the correct location in the chain. The filter has 'enabled: false' set so that a developer still has to enable it for it to take effect and allow cross origin access.

I would propose the same configuration that is used for the travel demo. See attached YAML bootstrap file.

The configuration should not be applied if an 'addCORSFilter' named node is already in place.

—

With this, then a developer only needs to enable the filter, this could be done either manually or with a bootstrap file. In the future possibly a YAML decorator can also be used.

—

This is increasingly relevant as more customers use Magnolia in a headless fashion.