code: public static void filterResponse(ContainerRequestContext requestContext,
                                        ContainerResponseContext responseContext,
                                        String extraAccesControlAllowHeaders) {
  
          String requestOrigin = requestContext.getHeaderString(Headers.ORIGIN);
          if (requestOrigin == null) {
              return;
          }
  
          // CORS validation already checked on request filter, see AbstractCorsRequestFilter
          MultivaluedMap<String, Object> responseHeaders = responseContext.getHeaders();
          responseHeaders.add(Headers.ACCESS_CONTROL_ALLOW_ORIGIN, requestOrigin);
          responseHeaders.add(Headers.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
          responseHeaders.add(Headers.ACCESS_CONTROL_ALLOW_METHODS,
                  Headers.DEFAULT_CORS_ACCESS_CONTROL_ALLOW_METHODS);
          responseHeaders.add(Headers.ACCESS_CONTROL_MAX_AGE, 72 * 60 * 60);
  
          if (extraAccesControlAllowHeaders != null) {
              responseHeaders.add(Headers.ACCESS_CONTROL_ALLOW_HEADERS,
                      Headers.DEFAULT_CORS_ACCESS_CONTROL_ALLOW_HEADERS + ","
                              + extraAccesControlAllowHeaders.trim());
          } else {
              responseHeaders.add(Headers.ACCESS_CONTROL_ALLOW_HEADERS,
                      Headers.DEFAULT_CORS_ACCESS_CONTROL_ALLOW_HEADERS);
          }
      }
docs: Apply CORS headers on response
  @param requestContext request context
  @param responseContext response context
  @param extraAccesControlAllowHeaders eventual extra allowed headers (nullable)