This is a Feature Proposal

Right now the event gateway allows all methods, headers, origins

CORS configuration should be per HTTP subscription. HTTP subscription should allow specifying additional cors field with the following structure (and default values):

{
  "cors": {
    "origins": [], // default "*"
    "methods": [], // default ["GET", "POST"]
    "headers": [],  // default ["Content-Type", "Authorization"]
    "allowCredentials": false // default "false"
  }
}

origins is an array but actually, it should return only matched origin in the request. See #16.

Similar or dependent issues:

• Support multiple CORS origins for sync subscriptions #16
• Review CORS configuration for both Config and Events API #309