Enable CORS in Tomcat

Question

SCENARIO:

Frontend: Angular application living in NGINX

Backend: java application living in Tomcat 8.5

The frontend needs to call backend Rest API. As far as I understand I need to allow CORS for this to happen:

so I went through Tomcat documentation and I added the cors filter to web.xml:

<filter>
    <filter-name>CorsFilter</filter-name>
    <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
    <init-param>
        <param-name>cors.allowed.origins</param-name>
        <param-value>http://dev.retex.global</param-value>
    </init-param>
    <init-param>
        <param-name>cors.allowed.methods</param-name>
        <param-value>GET,POST,HEAD,OPTIONS,PUT</param-value>
    </init-param>
    <init-param>
        <param-name>cors.allowed.headers</param-name>
        <param-value>Content-Type,X-Requested-With,Accept,Accept-Encoding,Accept-Language,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,Connection,Host</param-value>
    </init-param>
    <init-param>
        <param-name>cors.exposed.headers</param-name>
        <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>CorsFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

Then I restarted tomcat service

This setup is not working as expected:

$ curl -v \
> -H 'Accept: */*' \
> -H 'Accept-Encoding:gzip, deflate' \
> -H 'Accept-Language:en-US,en;q=0.9,es;q=0.8' \
> -H 'Access-Control-Request-Headers:authorization,content-type' \
> -H 'Access-Control-Request-Method:POST' \
> -H 'Connection:keep-alive' \
> -H 'Origin:http://dev.retex.global' \
> -H 'Host:dev.retex.global:8080' \
> -X OPTIONS \
> http://dev.retex.global:8080/returnitRest/rest/pickup/label
* timeout on name lookup is not supported
*   Trying 13.55.221.200...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Connected to dev.retex.global (13.55.221.200) port 8080 (#0)
> OPTIONS /returnitRest/rest/pickup/label HTTP/1.1
> Host:dev.retex.global:8080
> User-Agent: curl/7.47.1
> Accept: */*
> Accept-Encoding:gzip, deflate
> Accept-Language:en-US,en;q=0.9,es;q=0.8
> Access-Control-Request-Headers:authorization,content-type
> Access-Control-Request-Method:POST
> Connection:keep-alive
> Origin:http://dev.retex.global
>
< HTTP/1.1 403
< Content-Type: text/plain
< Content-Length: 0
< Date: Mon, 20 Nov 2017 09:54:22 GMT
<
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
* Connection #0 to host dev.retex.global left intact

QUESTION: What am I doing wrong?

did you ever figure this out? have the same problem – Riaan Dec 04 '18 at 16:13 — Riaan, Dec 04 '18 at 16:13

score 2 · Answer 1 · answered Dec 04 '18 at 16:17

This is what I did to solve this issue:

<filter>
    <filter-name>CorsFilter</filter-name>
    <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
    <init-param>
        <param-name>cors.allowed.origins</param-name>
        <param-value>http://domainA.com,https://domainA.com,http://localhost:4200</param-value>
    </init-param>
    <init-param>
        <param-name>cors.allowed.methods</param-name>
        <param-value>GET,POST,HEAD,OPTIONS,PUT</param-value>
    </init-param>
    <init-param>
        <param-name>cors.allowed.headers</param-name>
        <param-value>Content-Type,X-Requested-With,Accept,Accept-Encoding,Accept-Language,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,Connection,Host,authorization</param-value>
    </init-param>
    <init-param>
        <param-name>cors.exposed.headers</param-name>
        <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>CorsFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

Hope this helps

In my case the frontend (web pages in nginx) is exposed on port 443 while the backend (java app in tomcat) on 8443 hence web browsers will trigger cors https://medium.com/swlh/how-cors-cross-origin-resource-sharing-works-79f959a84f0e — masber, Feb 15 '20 at 04:59

Enable CORS in Tomcat

1 Answers1