title: Tomcat 8 ignores CORS filters (web.xml, in-code, etc)
body: <p>for some weird reason, Tomcat 8 (on a w2k12 server) is ignoring my CORS filter settings on tomcat8/conf/web.xml which are as follows, according to the Apache Tomcat 8 docs:</p>
  
  <pre><code>&lt;filter&gt;
      &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
      &lt;filter-class&gt;org.apache.catalina.filters.CorsFilter&lt;/filter-class&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;cors.allowed.origins&lt;/param-name&gt;
          &lt;param-value&gt;*&lt;/param-value&gt;
      &lt;/init-param&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>It does work with GET requests, but when I try to do a POST, i get the 403 Forbidden error saying:</p>
  
  <pre><code>Origin http://webapp.mycompany.com is not allowed by Access-Control-Allow-Origin.
  </code></pre>
  
  <p>Where <a href="http://webapp.mycompany.com" rel="nofollow">http://webapp.mycompany.com</a> is my company's hosting provider with standard features you get with a shared hosting with cpanel, my front-end is there and it send the requests to another domain where I have the Tomcat 8 Server installed and the webapp WAR which is a Jersey-based REST Api.</p>
  
  <p>Now, according to the defaults in Apache's official documents, that configuration I'm using is the minimum required for it to work.</p>
  
  <p>I tried then moving the filters to the application's web.xml instead, no luck, tried adding more configurations like methods allowed, tried adding the headers in the responses directly like this:</p>
  
  <pre><code>Response.status(Response.Status.OK)
          .entity(relaciona)
          .header("Access-Control-Allow-Origin", "*")
          .header("Access-Control-Allow-Methods", "POST, GET, OPTIONS, PUT, DELETE, HEAD")
          .header("Access-Control-Allow-Headers", "X-PINGOTHER, Origin, X-Requested-With, Content-Type, Accept")
          .header("Access-Control-Max-Age", "1728000")
          .build();
  </code></pre>
  
  <p>Didn't work.</p>
  
  <p>Any help on this would be greatly appreciated, and just to confirm, tried the following:</p>
  
  <ul>
  <li>Tried setting the configuration in both the server and the webapp web.xml files individually, no luck</li>
  <li>Tried adding the headers to each response in the Jersey REST Api, no luck</li>
  <li>The requests to the API are done with an HTML5 frontend with bootstrap and jQuery, tried adding the crossDomain:true to the ajax requests, no difference.</li>
  <li>Added the origin domain to the xml in both web and server web.xml files (tested individually) and neither worked</li>
  </ul>
  
  <p>Thanks!</p>