code: @Order @Bean ArmeriaServerConfigurator corsConfigurator(
      @Value("${zipkin.query.allowed-origins:*}") String allowedOrigins) {
      CorsServiceBuilder corsBuilder = CorsServiceBuilder.forOrigins(allowedOrigins.split(","))
        // NOTE: The property says query, and the UI does not use POST, but we allow POST?
        //
        // The reason is that our former CORS implementation accidentally allowed POST. People doing
        // browser-based tracing relied on this, so we can't remove it by default. In the future, we
        // could split the collector's CORS policy into a different property, still allowing POST
        // with content-type by default.
        .allowRequestMethods(HttpMethod.GET, HttpMethod.POST)
        .allowRequestHeaders(HttpHeaderNames.CONTENT_TYPE,
          // Use literals to avoid a runtime dependency on armeria-grpc types
          HttpHeaderNames.of("X-GRPC-WEB"))
        .exposeHeaders("grpc-status", "grpc-message", "armeria.grpc.ThrowableProto-bin");
      return builder -> builder.decorator(corsBuilder::build);
    }
docs: Configures the server at the last because of the specified {@link Order} annotation.