Geek Answers Handbook

Tomcat CORS Filter

I want to enable the tomcat CORS filter, I added it to web.xml:

<filter> <filter-name>CorsFilter</filter-name> <filter-class>org.apache.catalina.filters.CorsFilter</filter-class> </filter> <filter-mapping> <filter-name>CorsFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>

But that will not work. I tried using a special filter:

 <filter> <filter-name>SimpleCORSFilter</filter-name> <filter-class>com.common.SimpleCORSFilter</filter-class> </filter> <filter-mapping> <filter-name>SimpleCORSFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>

With this class:

 public class SimpleCORSFilter implements Filter { public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException { HttpServletResponse response = (HttpServletResponse) res; response.setHeader("Access-Control-Allow-Origin", "*"); response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE"); response.setHeader("Access-Control-Max-Age", "3600"); response.setHeader("Access-Control-Allow-Headers", "x-requested-with"); chain.doFilter(req, res); } }

And it works well, can you tell me why? I do not know if this is important, but I am using the Spring Framework.

+13
source share
3 answers

The org.apache.catalina.filters.CorsFilter filter first looks for the header in the request: Origin . If this header does not exist, the filter does not add any header to the response. Perhaps for this reason it does not work.

Also, in the POST request, find the Content-Type header. Something similar happens with other methods. You might want to see the code for this filter. There is a different flowchart :

CORS Flow Chart

+31
source

I get a similar problem and I found something that worked for me in tomcat doc tomcat-doc-CORSFilter I use a filter and init-param as shown below:

 <filter> <filter-name>CorsFilter</filter-name> <filter-class>org.apache.catalina.filters.CorsFilter</filter-class> <init-param> <param-name>cors.allowed.origins</param-name> <param-value>*</param-value> </init-param> <init-param> <param-name>cors.allowed.methods</param-name> <param-value>GET,POST,HEAD,OPTIONS,PUT</param-value> </init-param> <init-param> <param-name>cors.allowed.headers</param-name> <param-value>Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers</param-value> </init-param> <init-param> <param-name>cors.exposed.headers</param-name> <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value> </init-param> <init-param> <param-name>cors.support.credentials</param-name> <param-value>true</param-value> </init-param> <init-param> <param-name>cors.preflight.maxage</param-name> <param-value>10</param-value> </init-param> </filter> <filter-mapping> <filter-name>CorsFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>

Hope this helps!

+8
source

In my case with Ueditor, X-Requested-With should be X_Requested_With .

0
source

More articles:


All Articles