Take the 2-minute tour ×

I configures my Jetty server to allow cross domain http requests (allowedOrigins = *) and also to allow cross domain authentication (allowCredentials=true) using its CrossOriginFilter. Cross domain http requests without authentication requirement work ok. Now when it comes to http calls that require authentication It doesn't work out using JQuery. I use the following code and followed this example: http://www.aswinanand.com/2009/01/http-basic-authentication-using-ajax/

function login(username, password) {
    type: "GET",
    contentType: "application/json",
    dataType: "json",
    url: url,
    beforeSend: function(xhr) {
        var base64 = Base64.encode(username + ":" + password);
        xhr.setRequestHeader("Authorization", "Basic " + base64);
        xhr.withCredentials = true;
    error: function(data){
    success: function(data){

In HTTPFox i see the following request to the server:

OPTIONS /login HTTP/1.1
Access-Control-Request-Method   GET
Access-Control-Request-Headers  authorization,content-type

The server responds with a

HTTP/1.1 204 No Content

I also used the options below, which doesnt make a difference.

    username: username,
    password: password,

The error function always fires. Anybody an idea what the problem could be?

share|improve this question
Do you see this in your response header Access-Control-Allow-Origin:*? Great question by the way! Welcome to StackOverflow! –  jmort253 May 26 '12 at 21:39
I think it would be helpful if you could show any stacktraces related to the issue as well. –  jmort253 May 26 '12 at 21:42
ok, please check to see if that header is included in your response. If not, then it's possible the security is overriding the response headers. Need to see more logs to debug further. Good luck! :) –  jmort253 May 26 '12 at 21:48
@jmort253: no i dont see this header in the response from the server. The security of jetty? What kind of logs or stacktraces can I provide? –  hansi May 26 '12 at 21:49
This would be at the framework or server level. The server typically logs things at a much lower level than your app does, so you'd need to modify logging.properties (or whatever logger you use) and set it to log at DEBUG or ALL so you can see what the server and framework are doing under the hood. You're looking for any instance of the headers being set without the Access-origin header –  jmort253 May 26 '12 at 21:59
add comment

3 Answers

For SOAP stuff, the allowed headers should also include messagetype,soapaction

Beware that no wildcard is allowed to configure the allowed headers...

share|improve this answer
add comment
up vote 4 down vote accepted

As the default allowed headers are


I had to add the headers


Found this via the log file

DEBUG [2012-05-27 17:04:02,468] org.eclipse.jetty.servlets.CrossOriginFilter: Headers [authorization,content-type] are not among allowed headers [X-Requested-With, Content-Type, Accept, Origin]

Thanks for all the hints!

share|improve this answer
add comment

The response headers that you set in your application -- when security is not enabled 00 works just fine, as you've attested to. However, when security is enabled, your cross-domain requests fail.

This is likely due to the additional Filter and additional response headers that are set by the security filter in order to generate a response.

To solve this problem, the high level solution is that you must set your response headers prior to the time that the security Filter sets its response headers and/or commits them to the client.

You're also using Jetty; therefore, you can use the Jetty Cross Origin Filter to ensure that the response headers are set in the Filter chain, in the order that they need to be set:

Here is a list of parameters that you can pass into the Filter configuration in web.xml:






By default, the Allowed Origins response header is set to *, which implies that by default, any request can be made from any domain. You'll need to be sure to modify this to allow only domains that you intend to whitelist, assuming you don't want every request from all domains to be valid:

web.xml entry for the Filter:

<web-app ...>

Here is a list of additional resources that you may find helpful in solving this particular problem:

share|improve this answer
add comment

Your Answer


