Cherry-pick CORS changes from master to 7.3.x

assembly/assembly-wsmaster-war/src/main/java/org/eclipse/che/api/deploy/WsMasterModule.java

@@ -60,9 +60,6 @@
 import org.eclipse.che.api.workspace.server.spi.provision.env.MachineTokenEnvVarProvider;
 import org.eclipse.che.api.workspace.server.spi.provision.env.MavenOptsEnvVariableProvider;
 import org.eclipse.che.api.workspace.server.spi.provision.env.ProjectsRootEnvVariableProvider;
-import org.eclipse.che.api.workspace.server.spi.provision.env.WorkspaceAgentCorsAllowCredentialsEnvVarProvider;
-import org.eclipse.che.api.workspace.server.spi.provision.env.WorkspaceAgentCorsAllowedOriginsEnvVarProvider;
-import org.eclipse.che.api.workspace.server.spi.provision.env.WorkspaceAgentCorsEnabledEnvVarProvider;
 import org.eclipse.che.api.workspace.server.spi.provision.env.WorkspaceAgentJavaOptsEnvVariableProvider;
 import org.eclipse.che.api.workspace.server.spi.provision.env.WorkspaceIdEnvVarProvider;
 import org.eclipse.che.api.workspace.server.spi.provision.env.WorkspaceNameEnvVarProvider;
@@ -180,14 +177,6 @@ protected void configure() {
         .addBinding()
         .to(WorkspaceAgentJavaOptsEnvVariableProvider.class);
 
-    legacyEnvVarProviderMultibinders
-        .addBinding()
-        .to(WorkspaceAgentCorsAllowedOriginsEnvVarProvider.class);
-    legacyEnvVarProviderMultibinders
-        .addBinding()
-        .to(WorkspaceAgentCorsAllowCredentialsEnvVarProvider.class);
-    legacyEnvVarProviderMultibinders.addBinding().to(WorkspaceAgentCorsEnabledEnvVarProvider.class);
-
     bind(org.eclipse.che.api.workspace.server.event.WorkspaceJsonRpcMessenger.class)
         .asEagerSingleton();
     bind(org.eclipse.che.everrest.EverrestDownloadFileResponseFilter.class);

assembly/assembly-wsmaster-war/src/main/java/org/eclipse/che/api/deploy/WsMasterServletModule.java

@@ -52,8 +52,8 @@ protected void configureServlets() {
   private boolean isCheCorsEnabled() {
     String cheCorsEnabledEnvVar = System.getenv("CHE_CORS_ENABLED");
     if (cheCorsEnabledEnvVar == null) {
-      // by default CORS should be enabled
-      return true;
+      // by default CORS should be disabled
+      return false;
     } else {
       return Boolean.valueOf(cheCorsEnabledEnvVar);
     }

assembly/assembly-wsmaster-war/src/main/webapp/WEB-INF/classes/che/che.properties

@@ -685,20 +685,13 @@ che.core.jsonrpc.minor_processor_queue_capacity=10000
 che.metrics.port=8087
 
 # CORS settings
-# CORS filter on WS Master is turned on by default.
-# Use environment variable "CHE_CORS_ENABLED=false" to turn it off
+# CORS filter on WS Master is turned off by default.
+# Use environment variable "CHE_CORS_ENABLED=true" to turn it on
 # "cors.allowed.origins" indicates which request origins are allowed
 che.cors.allowed_origins=*
 # "cors.support.credentials" indicates if it allows processing of requests with credentials
 # (in cookies, headers, TLS client certificates)
 che.cors.allow_credentials=false
-# This property is used to provide value for WS Agent CORS allowed origins env variable from WS Master.
-# If set to null, then the value will be automatically provided by WS Agent.
-che.wsagent.cors.allowed_origins=NULL
-# This property is used to provide value for WS Agent CORS credentials origins env variable from WS Master,
-che.wsagent.cors.allow_credentials=true
-# This property is used to provide value for WS Agent CORS enabling.
-che.wsagent.cors.enabled=true
 
 ## Factory defaults.
 # Editor and plugin which will be used for factories which are created from remote git repository