Merge remote-tracking branch 'origin/add-cors' into add-cors

docs/setup/settings.asciidoc

@@ -452,7 +452,7 @@ deprecation warning at startup. This setting cannot end in a slash (`/`).
  | experimental[] Set to `true` to allow browser code to access response body whenever request performed with user credentials. *Default:* `false`
 
 | `server.cors.origin:`
- | experimental[] List of origins permitted to access resources. You must specify `server.cors.origin` when `server.cors.credentials: true`. *Default:* "*"
+ | experimental[] List of origins permitted to access resources. You must specify explicit hostnames and not use `*` for `server.cors.origin` when `server.cors.credentials: true`. *Default:* "*"
 
 | `server.compression.referrerWhitelist:`
  | Specifies an array of trusted hostnames, such as the {kib} host, or a reverse

src/core/server/http/http_config.test.ts

@@ -294,7 +294,7 @@ describe('cors', () => {
       ).toThrow();
     });
 
-    it('can be configures as "*" wildcard', () => {
+    it('can be configured as "*" wildcard', () => {
       expect(config.schema.validate({ cors: { origin: '*' } }).cors.origin).toBe('*');
     });
   });