Apache Tomcat and CORS

Question

I'm working with a server and I am trying to do Cross Domain Scripting.

I've tried to add http://software.dzhuvinov.com/cors-filter-installation.html and have placed the java file in .../tomcat/lib/ (and in .../tomcat/webapps/MYAPP/WEB-INF/lib/ because it wasn't working) and have modified web.xml to include...

<servlet>
    <description>Desciption</description>
    <display-name>Displayname</display-name>
    <servlet-name>myservlet</servlet-name>
    <servlet-class>java.path</servlet-class>
</servlet>

<servlet-mapping>
    <servlet-name>myservlet</servlet-name>
    <url-pattern>/wsdl</url-pattern>
</servlet-mapping>
<filter>
     <filter-name>CORS</filter-name>
     <filter-class>com.thetransactioncompany.cors.CORSFilter</filter-class> 
</filter>

<filter-mapping>
    <filter-name>CORS</filter-name>
    <servlet-name>myservlet</servlet-name>
</filter-mapping>

And I restart the web server.

I can't get the Access-Control-Allow-Origin to work. I keep getting 403 errors.

I guess I must have not followed the 3 steps on the website correctly. Any ideas how to make it work?

Thanks.

Edit1: I declare my url and my soap message prior to this call as url, and soapMessage. I'm sure they are both well formed since they work fine in soapUI.

The call is:

$.ajax({ 
    type: "POST",
        url: url,
        dataType: "xml",
        contentType: "text/xml",
        //crossDomain: true, 
        data: soapMessage,
        //xhrFields: {
        //  withCredentials: true
        //},
        success: function(data){ 
            var xml = data.xml;
            console.log("Success!");
            console.log(xml);
            //[do something with the xml] 
        }, 
        error: function(data){ 
            var xml = data.xml;
            console.log("Error!");
            console.log(xml);
            //[do something with the xml] 
        }, 
        complete: function(data){ 
            var xml = data.xml;
            console.log("Complete!");
            console.log(xml);
            //[do something with the xml] 
        }

I've been trying different fields with little luck. I'm not sure if it is of note, but when I don't include the dataType the response header indicates a the Access-Control-Allow-Origin I would want to see and returns a 415 Error (Unsupport Media Type).

Example Request Header:

OPTIONS /servlet/wsdl?wsdl HTTP/1.1
Host: otherserver:8080
Connection: keep-alive
Access-Control-Request-Method: POST
Origin: thiswebpage.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1
Access-Control-Request-Headers: origin, content-type, accept
Accept: */*
Referer: thiswebpage.com/thisForm.cfm
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Example Response Header:

HTTP/1.1 403 Forbidden
Server: Apache-Coyote/1.1
Content-Type: text/plain
Content-Length: 86
Date: Tue, 28 Aug 2012 13:12:04 GMT

There are other filters (the web.xml file is huge) but the only ones that could be effecting things are these. I'd need to go to the company which created the file since my boss will likely not let me touch these (I'm only an intern).

<filter>
    <filter-name>agentSecurityModeFilter</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>agentSecurityModeFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>
<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

I'm not sure what they are doing here... it appears they are adding the same filter twice to the same url pattern with different names.

Again, thanks!

Can you include a sample http request and response, along with a code snippet of how you are making the request? Do you have any other filters installed? A 403 sounds like a possible auth error, which means the request could be getting rejected by some other filter. — monsur
I've made some edits to include the questions you proposed. I'm about to read about the other filter they have at static.springsource.org/spring/docs/1.2.x/api/org/… and see if it could be the problem. Thanks for the comment. — Sraaz

Mariusz Mariusz · Accepted Answer · 2013-04-06T20:05:00

Did you tried to configure the CORSFilter in following way?

<filter>
    <filter-name>CORS</filter-name>
    <filter-class>com.thetransactioncompany.cors.CORSFilter</filter-class>

    <init-param>
            <param-name>cors.allowOrigin</param-name>
            <param-value>thiswebpage.com</param-value>
    </init-param>
</filter>

Apache Tomcat and CORS

1 Answers