I'm working on adding CORS support there are several things that can be configured in this case. Below is an example of the options that are currently available:

public interface CorsConfiguration {

    public abstract boolean isCorsSupportEnabled();

    public abstract boolean exposeHeaders();

    public abstract String getExposeHeaders();

    public abstract boolean anyOrigin();

    public abstract boolean allowCookies();

    public abstract boolean hasMaxAge();

    public abstract long getMaxAge();

    public abstract Set<String> getValidRequestMethods();

    public abstract Set<String> getValidRequestHeaders();

}

How do we want users to configure these configuration options? Using a CDI annotation with "sensible" default values or specify them in web.xml?

cheers, 

/Dan