title: POST REST API calls not working on Chrome browser but works on IE browser
body: <p>We have Web application for which, UI is hosted on one Apache server on one host and back-end REST API service is hosted on tomcat server on different host.
  For UI : Node.js is used and it is hosted on Apache
  For API : Java 8 , Spring REST is used and war file is hosted on tomcat 8.5.32</p>
  
  <h2>The Problem:</h2>
  
  <p>While using Chrome browser (Version: 71.0.3578.80) for all POST API calls the server responds with error code 403 (forbidden), but for IE browser(version 11.0.105), the same POST APIs returns response with status 200 (Success).
  Above behavior is observed for all POST request. </p>
  
  <p>Following are request and response headers for chrome browser:</p>
  
  <h2>Request Headers:</h2>
  
  <pre><code>Accept: application/json, text/plain, */*
  Accept-Encoding: gzip, deflate, br
  Accept-Language: en-US,en;q=0.9
  Connection: keep-alive
  Content-Length: 6559
  Content-Type: application/json
  Cookie: &lt;cookies&gt;
  Host: &lt;myhost&gt;.com
  Origin: https://&lt;myhost&gt;.com
  Referer: https://&lt;myhost&gt;.com/beta/
  User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36
  </code></pre>
  
  <h2>Response Headers:</h2>
  
  <pre><code>Access-Control-Allow-Credentials: true
  Access-Control-Allow-Origin: https://&lt;myhost&gt;.com
  Connection: Keep-Alive
  Content-Length: 0
  Content-Type: text/plain
  Date: Mon, 11 Feb 2019 11:49:25 GMT
  Keep-Alive: timeout=5, max=95
  Server: Apache
  Strict-Transport-Security: max-age=31536000
  </code></pre>
  
  <h2>API call general details:</h2>
  
  <pre><code>Request URL: https://&lt;myhost&gt;.com/services/v1/settings
  Request Method: POST
  Status Code: 403 
  Remote Address: &lt;ip address&gt;:443
  Referrer Policy: no-referrer-when-downgrade
  </code></pre>
  
  <h2>Request Payload:</h2>
  
  <pre><code>{"userId":"test", "someFlag": "someValue"}
  </code></pre>
  
  <p>Could you help to understand what i'm missing in above headers?</p>
  
  <h2>Findings:</h2>
  
  <p>If we revert back to the tomcat version 8.5.29 from version 8.5.32 then POST API request calls works fine on all browsers. </p>
  
  <p>I also found that there is fix done for Tomcat 8.5.32 to 
  <a href="https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.32" rel="nofollow noreferrer">https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.32</a> : Low: CORS filter has insecure defaults <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8014" rel="nofollow noreferrer">CVE-2018-8014</a> which might causing this issue but i'm not able to figure out the exact problem and what headers changes should i do to get this POST request work on Chrome browsers.</p>