title: Enabling a CORS Response Filter in Tomcat 8.0
body: <p>I am attempting to call a web service on one server from another (cross origin) using a fairly basic <code>jQuery.ajax</code> POST request. </p>
  
  <pre><code>        return $.ajax({
              type: "POST",
              url: "http://dev.hostname.com/ws/account/example1@example.com?property_id=1&amp;custnum=123456",
              dataType:"json"
          });
  </code></pre>
  
  <p>I am always getting the following <code>error</code> response ... </p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load
    <a href="http://dev.hostname.com/ws/account/example1@example.com?property_id=1&amp;custnum=123456" rel="nofollow">http://dev.hostname.com/ws/account/example1@example.com?property_id=1&amp;custnum=123456</a>.
    No 'Access-Control-Allow-Origin' header is present on the requested
    resource. Origin <code>http://localhost:63342</code> is therefore not allowed
    access.</p>
  </blockquote>
  
  <p>The web service is a Java-built Jersey based web service hosted on <code>Apache Tomcat/8.0.8</code>. I have tried sending the request as JSONP but that ran me into issues when attempting to handle the callbacks from the promise object. That's another post however ... As an alternative I decided to look into implementing a CORS Response solution. Now I am VERY new to Java programming and am not that comfortable with it so please bear with me.</p>
  
  <p>I have looked at two primary solutions for implementing CORS. One is to build a custom response filter. I could not get that to work but then discovered that since Tomcat 7.0 a filter is supposedly already provided. I have seen several posts on this second solution but had absolutely no luck with it. Using the guidelines provided in the <a href="http://tomcat.apache.org/tomcat-7.0-doc/config/filter.html#CORS_Filter" rel="nofollow">Apache Tomcat Documentation</a> I added the following FILTER information to the web.xml file of the application (I have also tried adding it to the web.xml of the root and it didn't work there either).</p>
  
  <pre><code>&lt;filter&gt;
      &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
      &lt;filter-class&gt;org.apache.catalina.filters.CorsFilter&lt;/filter-class&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;cors.allowed.origins&lt;/param-name&gt;
          &lt;param-value&gt;*&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;cors.allowed.methods&lt;/param-name&gt;
          &lt;param-value&gt;GET,POST,HEAD,OPTIONS,PUT&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;cors.allowed.headers&lt;/param-name&gt;
          &lt;param-value&gt;Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers, Last-Modified&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;cors.exposed.headers&lt;/param-name&gt;
          &lt;param-value&gt;Access-Control-Allow-Origin,Access-Control-Allow-Credentials&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;cors.support.credentials&lt;/param-name&gt;
          &lt;param-value&gt;true&lt;/param-value&gt;
      &lt;/init-param&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>Since I am using <code>Tomcat 8.0.8</code>. I would have expected this to work, yet I continue to get the same error. Am I missing something?</p>
  
  <p>Thanks for your help. </p>
  
  <p><strong>UPDATED</strong> </p>
  
  <p>I am adding the headers from Firebug when calling the service in Firefox. This is the Request header ... </p>
  
  <pre><code>Accept  application/json, text/javascript, */*; q=0.01
  Accept-Encoding gzip, deflate
  Accept-Language en-US,en;q=0.5
  Cache-Control   no-cache
  Connection  keep-alive
  Content-Length  0
  Host    dev.hostname.com
  Origin  http://localhost:63342
  Pragma  no-cache
  Referer http://localhost:63342/keurig/default.html
  User-Agent  Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0
  </code></pre>
  
  <p>This is the Response header</p>
  
  <pre><code>Content-Length  0
  Content-Type    text/plain
  Date    Thu, 21 Aug 2014 17:50:58 GMT
  Server  Apache-Coyote/1.1
  </code></pre>
  
  <p>I definitely do not see any of the "Access-Control-*" headers that would expect to be see in the response.</p>