Inspired from https://github.com/spring-projects/spring-fu/commit/c360bab5c0f62cda2ebd85e8c0adc3aadc1f63c6.

cors {
    "/api/**" {
        allowedOrigins = listOf("first.example.com", "second.example.com")
        allowedMethods = listOf("GET", "PUT", "POST", "DELETE")
    }
    "/static/**" {
        allowedOrigins = listOf("full.config.example.com")
        allowedMethods = listOf("GET")
        allowedHeaders = listOf("*")
        exposedHeaders = listOf("Content-Location")
        allowCredentials = true
        maxAge = 3600
    }
    path("/public/**") // Enable CORS with permit default values
}

Comment From: sdeleuze

I still think this would be useful, but I don't have the bandwidth to work on this as it competes with higher priorities, so I am closing this issue with the hope that somebody will contribute a related pull request that I could review.