Refactor CORS handling into injectable components

core-processor/src/main/java/io/micronaut/inject/beans/visitor/IntrospectedTypeElementVisitor.java

@@ -52,7 +52,6 @@
 import java.lang.annotation.RetentionPolicy;
 import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.Collection;
 import java.util.Comparator;
 import java.util.HashMap;
 import java.util.HashSet;

http-server-tck/src/main/java/io/micronaut/http/server/tck/tests/cors/CrossOriginTest.java

@@ -451,7 +451,7 @@ private static MutableHttpRequest<?> preflight(URI uri, String originValue, Http
             .header(HttpHeaders.ACCESS_CONTROL_REQUEST_METHOD, method);
 
         if (allowPrivateNetwork) {
-            request.header(HttpHeaders.ACCESS_CONTROL_REQUEST_PRIVATE_NETWORK, method);
+            request.header(HttpHeaders.ACCESS_CONTROL_REQUEST_PRIVATE_NETWORK, StringUtils.TRUE);
         }
 
         return request;

http-server/src/main/java/io/micronaut/http/server/HttpServerConfiguration.java

@@ -932,10 +932,32 @@ public static class CorsConfiguration implements Toggleable {
         private @Nullable CrossOriginEmbedderPolicy crossOriginEmbedderPolicy;
         private @Nullable CrossOriginResourcePolicy crossOriginResourcePolicy;
 
+        private CorsFilterConfiguration filter = new CorsFilterConfiguration();
+
         private Map<String, CorsOriginConfiguration> configurations = Collections.emptyMap();
 
         private final Map<String, CorsOriginConfiguration> defaultConfiguration = new LinkedHashMap<>(1);
 
+        /**
+         * Returns the CORS filter configuration.
+         *
+         * @return The CORS filter configuration
+         * @since 5.2.0
+         */
+        public CorsFilterConfiguration getFilter() {
+            return filter;
+        }
+
+        /**
+         * Sets the CORS filter configuration.
+         *
+         * @param filter The CORS filter configuration
+         * @since 5.2.0
+         */
+        public void setFilter(CorsFilterConfiguration filter) {
+            this.filter = filter;
+        }
+
         /**
          * @return Whether cors is enabled. Defaults to false.
          */
@@ -1044,6 +1066,47 @@ public void setCrossOriginEmbedderPolicy(@Nullable CrossOriginEmbedderPolicy cro
         public void setCrossOriginResourcePolicy(@Nullable CrossOriginResourcePolicy crossOriginResourcePolicy) {
             this.crossOriginResourcePolicy = crossOriginResourcePolicy;
         }
+
+        /**
+         * Configuration for enabling or disabling the CORS server filter.
+         *
+         * <p>Disabling the filter disables all server-side CORS processing, including rules
+         * declared with {@link io.micronaut.http.server.cors.CrossOrigin}. This differs from
+         * {@link CorsConfiguration#isEnabled()}, which controls server-wide CORS
+         * configurations but still permits route-level CORS annotations.</p>
+         *
+         * @since 5.2.0
+         */
+        @ConfigurationProperties("filter")
+        public static class CorsFilterConfiguration implements Toggleable {
+            /**
+             * Whether the CORS server filter is enabled by default.
+             */
+            public static final boolean DEFAULT_ENABLED = true;
+
+            private boolean enabled = DEFAULT_ENABLED;
+
+            /**
+             * Returns whether the CORS server filter is enabled.
+             *
+             * @return {@code true} if the CORS server filter is enabled
+             */
+            @Override
+            public boolean isEnabled() {
+                return enabled;
+            }
+
+            /**
+             * Sets whether the CORS server filter is enabled. Default value {@value #DEFAULT_ENABLED}.
+             * Setting this to false disables all server-side CORS processing, including rules
+             * declared with the CrossOrigin annotation.
+             *
+             * @param enabled {@code true} to enable the CORS server filter
+             */
+            public void setEnabled(boolean enabled) {
+                this.enabled = enabled;
+            }
+        }
     }
 
     /**