code: @Override
      protected boolean shouldNotFilter(final HttpServletRequest request) throws ServletException {
          SiteContext siteContext = SiteContext.getCurrent();
          HierarchicalConfiguration config = siteContext.getConfig();
          try {
              HierarchicalConfiguration corsConfig = config.configurationAt(CONFIG_KEY);
              if (corsConfig != null) {
                  return !corsConfig.getBoolean(ENABLE_KEY, false);
              }
          } catch (Exception e) {
              logger.debug("Site '{}' has no CORS configuration", siteContext.getSiteName());
          }
          return true;
      }
docs: Exclude requests for sites that have no configuration or it is marked as disabled.