CORSFilter.java: allow port 9000 for interop with react HMR

[snickell]

We enabled react hot module replacement (code-dot-org/code-dot-org#56882), which uses the react devserver. This proxies requests from port 9000 to port 3000, which means the browser's origin will be port 9000. This means we expect to see valid requests to Javabuilder originating from port 9000.

This PR updates the CORSFilter's ALLOWED_ORIGINS.

[snickell]

So I did the easy part just to get the ball rolling, but now the hard part: how do I test this? 🙈

[bencodeorg]

Not sure if these are 100% up to date, but are you able to get local javabuilder running using these instructions?

https://github.com/code-dot-org/javabuilder/blob/main/org-code-javabuilder/README.md#setup-your-project

[bencodeorg]

Actually, I'm confused b/c the Slack discussion is talking about a deployed Javabuilder instance, and dev/ code (I thought?) was for local Javabuilder...probably totally missing something though, been a while since I've thought about Javabuilder...

[snickell]

I'm confused enough that I'm not 100% sure if I'm confused or not... but this might clarify. It sounds to me like Molly is proposing we deploy a new dev instance to lambda, and test using that?

Testing instructions from molly

Molly slacked me these instructions on testing, but I haven't done it yet:

instructions for testing Javabuilder changes are here: https://github.com/code-dot-org/javabuilder?tab=readme-ov-file#deploying-a-dev-instance. Just noticed the link in the readme has a typo, the link in step 3 should be https://github.com/code-dot-org/javabuilder/tree/main/cicd#deploying-a-development-environment

easiest way to test it's working once you have things set up:
Go to http://localhost-studio.code.org:3000/s/allthethings/lessons/44/levels/2 with a levelbuilder account (or a verified teacher account, or student of a verified teacher)
Press run
See if it runs in the console
You can make sure it's talking to your instance by looking at the network tab, there should be a websocket request to your dev instance rather than javabuilder-test.code.org

[bencodeorg]

Cool yeah I think Molly's instructions are the one you want, ignore my suggestion!