Geek Answers Handbook

Cross-source requests are blocked in tomcat 8

this may seem like a known problem, and there are many questions on this subject, however my situation is very strange. I have a simple web application deployed to tomcat 8.0.36. I configured CORS correctly:

<filter> <filter-name>CorsFilter</filter-name> <filter-class>org.apache.catalina.filters.CorsFilter</filter-class> </filter> <filter-mapping> <filter-name>CorsFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>

Cross-search requests are blocked by the browser:

No header "Access-Control-Allow-Origin" is present on the requested resource. Origin ' https://www.mytestpage.com ' is therefore not allowed. The response had an HTTP status code of 403.

In the tomcat log file, I also see a 403 response code. Interestingly, my application code never runs in the case of cross-origin requests. Requests are blocked until my application, and 403 is sent immediately. I do not have apache in front of tomcat, this is a simple cat. I tried a lot of things, including whitelisting sources and specifying allowed headers - nothing helped. I also tried to set the header programmatically until I found that the code never executes in the case of a cross origin request.

UPD: the endpoint accepts POST requests. Those POST requests are sent as XmlHttpRequests from the JS fragment.

Any ideas what this could be?

ps I can make successful the same origin requests.

+5
source share
2 answers

You really need to install both Access-Control-Allow-Origin and Access-Control-Allow-Methods . Here is an example:

 Access-Control-Allow-Origin: http://www.myhost.com Access-Control-Allow-Methods: GET, POST, PUT, DELETE

You should also accept the OPTIONS method, returning the Access-Control-Allow-* header lines. Some browsers may issue such a request before your actual request (for example, a "PUT" request) in order to obtain information about access to the service.

+1
source

I found out what the problem is: I had to set the Content-Type header in the request, otherwise the request will be blocked. - Tomcat CORS Filter

0
source

More articles:


All Articles