CORS allows, but the request header is mixed with another host

Question

I have a tomcat 8 server with CORS enabled in web.xml . The CORS plugin works in most cases, but sometimes it mixes the header request from the local host and server

 XMLHttpRequest cannot load http://mipldevlinux7:6060/juneberry/data/blue-marbles/config.json. The 'Access-Control-Allow-Origin' header has a value 'http://localhost:3000' that is not equal to the supplied origin. Origin 'http://mipldevlinux7:7777' is therefore not allowed access 

My tomcat server is on a server named mipldevlinux7 in port 6060 , I have a production server on the same host on port 7777 .

I am doing my development on localhost:3000 , and my colleague is running his dev server on localhost:8080 .

We got a CORS error, and the error mixes the headers between our localhosts with 3000 , and sometimes 8080 . Sometimes we even get a mipledevlinux7:7777 header request, why do we request localhost.

CORS, which I use, is an assembly in CORS tomcat 8 provided:

 <filter> <filter-name>CorsFilter</filter-name> <filter-class>org.apache.catalina.filters.CorsFilter</filter-class> <init-param> <param-name>cors.allowed.origins</param-name> <param-value>*</param-value> </init-param> <init-param> <param-name>cors.allowed.methods</param-name> <param-value>GET,POST,HEAD,OPTIONS,PUT</param-value> </init-param> <init-param> <param-name>cors.allowed.headers</param-name> <param-value>Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,Last-Modified</param-value> </init-param> <init-param> <param-name>cors.exposed.headers</param-name> <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value> </init-param> <init-param> <param-name>cors.support.credentials</param-name> <param-value>true</param-value> </init-param> </filter> <filter-mapping> <filter-name>CorsFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> 

Is tomcat caching the request header or in any way uses the last request header, which causes an overflow, and blocks all requests?

Answer 1

If cors.support.credentials set to true, use cors.preflight.maxage to -1 to disable the browser cache:

 <init-param> <param-name>cors.preflight.maxage</param-name> <param-value>-1</param-value> </init-param> 

Are you sure you want to set cors.allowed.origins to * ?