title: how do i configure tomcat NOT to perform authentication or authorization on CORS OPTIONS requests
body: <p>I am attempting to make a CORS request to a Tomcat-hosted web-app (details below).</p>
  
  <p>I have set up the CORS header stuff (in Apache httpd.conf) and it appears to be working, but the pre-flight OPTIONS request generated (I assume) by Chrome, which rightfully has no auth header, is failing with error 401.</p>
  
  <p>I think I need to convince Apache or Tomcat not to do any auth for the OPTIONS request, but rather, to complete it with 200.</p>
  
  <p>1) am I barking up the right tree?<br>
  2) Should I put a CORS filter in Tomcat (web.xml) instead of a set of Header Sets in Apache (httpd.conf)?<br>
  3) I can't find how to config apache to do that - any pointers?  Closest hint I've found is @Thomas Broyer in April last year responding to <a href="https://stackoverflow.com/questions/22769263/enable-cors-for-tomcat-applications-with-credentials-support">Enable CORS for tomcat applications with credentials support</a> thus:<br></p>
  
  <pre><code>you have to declare a &lt;security-constraint&gt; with &lt;http-method&gt;OPTIONS&lt;/http-method&gt; and no &lt;auth-constraint&gt;."
  </code></pre>
  
  <p>Any help is greatly appreciated!  I'm into multiple days trying to solve this...</p>
  
  <p>===================</p>
  
  <p>Current state of play:</p>
  
  <p>Request:</p>
  
  <pre><code>Remote Address:54.245.121.9:80
  Request URL:http://ec2-54-245-121-9.us-west-2.compute.amazonaws.com/v1/plant
  Request Method:OPTIONS
  Status Code:401 Unauthorized
  Request Headersview parsed
  OPTIONS /v1/plant HTTP/1.1
  Host: ec2-54-245-121-9.us-west-2.compute.amazonaws.com
  Connection: keep-alive
  Access-Control-Request-Method: POST
  Origin: http://ec2-54-245-121-9.us-west-2.compute.amazonaws.com:8084
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
  Access-Control-Request-Headers: accept, authorization, content-type
  Accept: */*
  Referer: http://ec2-54-245-121-9.us-west-2.compute.amazonaws.com:8084/add
  Accept-Encoding: gzip, deflate, sdch
  Accept-Language: en-US,en;q=0.8,de;q=0.6
  </code></pre>
  
  <p>Response:</p>
  
  <pre><code>Headersview parsed
  HTTP/1.1 401 Unauthorized
  Date: Thu, 29 Jan 2015 23:00:34 GMT
  Server: Apache-Coyote/1.1
  X-Content-Type-Options: nosniff
  X-XSS-Protection: 1; mode=block
  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  Pragma: no-cache
  Expires: 0
  X-Frame-Options: DENY
  WWW-Authenticate: Basic realm="Realm"
  Content-Type: text/html;charset=utf-8
  Content-Language: en
  Content-Length: 1104
  Access-Control-Allow-Origin: http://ec2-54-245-121-9.us-west-2.compute.amazonaws.com:8084
  Vary: Origin
  Access-Control-Allow-Methods: GET, POST
  Access-Control-Allow-Headers: origin, accept, authorization, content-type, x-requested-with
  Access-Control-Allow-Credentials: true
  Connection: close
  </code></pre>
  
  <p>==============================</p>
  
  <p>More about my app:</p>
  
  <p>I have a MEAN web-app with the node.js server running on :8084.</p>
  
  <p>There is an existing Tomcat/Java web-app with a REST API running on :80 (front-ended by Apache)...</p>
  
  <p>The Angular.js-based js code in the client (in Chrome in my testing) is calling the REST API.</p>
  
  <p>Because port 8084 != port 80, it's a CORS request.</p>