add Access-Control-Allow-Credentials header

[st-h]

fixes #415

[gaul]

@reimannf could you review this?

[reimannf]

I think CORS does not include cookies/credentials on cross-origin requests by default. Both, client and server has to opt-in if they want to do this. So instead of always sending that header, which might open some attacking space, I suggest to introduce a config property PROPERTY_CORS_ALLOW_CREDENTIAL here:

s3proxy/src/main/java/org/gaul/s3proxy/S3ProxyConstants.java

Lines 41 to 42 in 217308a

	public static final String PROPERTY_CORS_ALLOW_HEADERS =
	"s3proxy.cors-allow-headers";

You might want to send the header always with the value configured in PROPERTY_CORS_ALLOW_CREDENTIAL unless you default to something different than true and make this an active decision.

[gaul]

@st-h Could you address the review comment so I can merge this?

[st-h]

@gaul thanks for the reminder. I totally forgot this PR was still open and I was chugging along with my local docker image. Would have been up for a surprise when switching to a different computer. I just added the requested property.

[st-h]

@gaul Any chance we can still merge and release this?

[gaul]

Thank you for your contribution and patience @st-h!