title: cross origin requests are blocked in tomcat 8 with HTTP status code 403
body: <p>it may seem like a known issue and many questions exist on the topic, however, my situation is very strange. I have a simple web application that is deployed on tomcat 8.0.36. I have configured the CORS properly:</p>
  
  <pre><code>&lt;filter&gt;
  &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
  &lt;filter-class&gt;org.apache.catalina.filters.CorsFilter&lt;/filter-class&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
  &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
  &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>The cross-origin requests are blocked by the browser:</p>
  
  <p>No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '<a href="https://www.mytestpage.com" rel="noreferrer">https://www.mytestpage.com</a>' is therefore not allowed access. The response had HTTP status code 403.</p>
  
  <p>In the tomcat log file I also see the response code of 403. What is interesting is that the code of my application is never executed in case of cross-origin requests. The requests are blocked before reaching my application and 403 is sent immediately. I have no apache in front of tomcat, it's plain tomcat. I have tried many things, including whitelisting the origins and specifying allowed headers - nothing helped. I've also tried to set the header programmatically until I found that the code in case of cross-origin request is never executed.</p>
  
  <p>UPD: The end point accepts POST requests. Those POST requests are sent as XmlHttpRequests from the JS snippet.   </p>
  
  <p>Any ideas what it can be?</p>
  
  <p>p.s I can make successful same origin requests.</p>