I would recommend to host an own swagger-ui instance and not using the one in thorntail, because I consider swagger-ui a development tool, which I wouldn't use in a thorntail service directly.
If swagger-ui is hosted as an external standalone service, and you only need one installation for all developers because its just html and javascript, then you only need to take care about CORS in your service for the endpoint providing the */swagger.json. Providing the swagger.json in a production environment shouldn't be a problem, because its just the doc of your rest api.
See the following example for implementing a CORS filter copied from CORS issue on java web application
public class CorsFilter implements Filter {
@Override
public void init(FilterConfig filterConfig) throws ServletException {
}
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
HttpServletResponse response = (HttpServletResponse) servletResponse;
response.setHeader("Access-Control-Allow-Origin", "*");
response.setHeader("Access-Control-Allow-Credentials", "true");
response.setHeader("Access-Control-Allow-Methods", "POST, GET, HEAD, OPTIONS");
response.setHeader("Access-Control-Allow-Headers", "Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers");
if ("OPTIONS".equalsIgnoreCase((HttpServletRequest) servletRequest.getMethod())) {
response.setStatus(HttpServletResponse.SC_OK);
} else {
filterChain.doFilter(servletRequest, response);
}
}
@Override
public void destroy() {
}
}
Here you see how to enable the servlet filter.
<filter>
<filter-name>CorsFilter</filter-name>
<filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>CorsFilter</filter-name>
<url-pattern>/swaggerJsonEndpoint/*</url-pattern>
</filter-mapping>
