Update readme

Author: ben-hamelin

README.md

@@ -26,6 +26,36 @@ This configuration limits memory usage to 512mb. This should be enough for most
 - "ES_JAVA_OPTS=-Xms512m -Xmx512m"` environment variable in `docker-compose.elasticsearch.yaml`
 ```
 
+## CORS settings
+
+To better support decoupled architecture testing, HTTP.CORS configuration to expose the server to any origin is in place.
+
+```yaml
+- "http.cors.allow-origin=*"
+- "http.cors.enabled=true"
+- "http.cors.allow-headers=X-Requested-With,X-Auth-Token,Content-Type,Content-Length,Authorization,Access-Control-Allow-Origin,Access-Control-Request-Headers"
+- "http.cors.allow-credentials=true"
+- "http.cors.allow-methods: OPTIONS, HEAD, GET, POST, PUT, DELETE"
+```
+
+When paired with a frontend request with the proper headers, this should allow for cross-origin requests.
+
+```script
+// Example JS fetch() with headers
+fetch('http://vca.ddev.site:9200/elasticsearch_index_db/_search', {
+      method: 'post',
+      body: querystring,
+      //headers: { 'Content-Type': 'application/json' },
+      headers: {
+              'Origin': 'http://localhost:8000',
+              'Content-Type': 'application/json',
+              'Access-Control-Allow-Origin': '*',
+              'Access-Control-Request-Headers': 'access-control-allow-origin,content-type',
+            },
+    })
+```
+
+
 If you change this variable, make sure to remove the `#ddev-generated` line at the top of the file. 
 
 You can use `ddev logs -s elasticsearch` to investigate what the elasticsearch daemon has been up to, or if you have a RAM-related crash.