code: @Override
      protected void doFilterInternal(final HttpServletRequest request, final HttpServletResponse response,
                                      final FilterChain filterChain) throws ServletException, IOException {
          SiteContext siteContext = SiteContext.getCurrent();
          HierarchicalConfiguration corsConfig = siteContext.getConfig().configurationAt(CONFIG_KEY);
          response.setHeader(CORSFilter.ALLOW_ORIGIN, corsConfig.getString(ALLOW_ORIGIN_KEY, ALLOW_ORIGIN_DEFAULT));
          response.setHeader(CORSFilter.ALLOW_CREDENTIALS, corsConfig.getString(ALLOW_CREDENTIALS_KEY,
              ALLOW_CREDENTIALS_DEFAULT));
          response.setHeader(CORSFilter.ALLOW_METHODS, corsConfig.getString(ALLOW_METHODS_KEY, ALLOW_METHODS_DEFAULT));
          response.setHeader(CORSFilter.ALLOW_HEADERS, corsConfig.getString(ALLOW_HEADERS_KEY, ALLOW_HEADERS_DEFAULT));
          response.setHeader(CORSFilter.MAX_AGE, corsConfig.getString(MAX_AGE_KEY, MAX_AGE_DEFAULT));
          filterChain.doFilter(request, response);
      }
docs: Copy the values from the site configuration to the response headers.