title: CORS issue on java web application
body: <p>The backend is developed by Spring MVC and hosted in tomcat.</p>
  
  <p>When I use postman dev tool in Chrome to test the endpoint (Restful), everything is working fine. The "Access-Control-Allow-Origin", "*" is successfully added in the server. like below screenshot
  <a href="https://i.stack.imgur.com/eZa3e.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/eZa3e.png" alt="enter image description here"></a></p>
  
  <p>But when I wrote the Ajax to make the same request. Because browser has the Origin Policy (postman has no this policy), it will first send an HTTP OPTIONS request header to the server to determine whether the actual request is safe to send. like below screenshot.
  <a href="https://i.stack.imgur.com/ve5Ln.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ve5Ln.png" alt="enter image description here"></a></p>
  
  <p>The response header is quite different to the one I got from postman, and there is no "Access-Control-Allow-Origin", "*" in the header. I think the server just can't accept the options request.</p>
  
  <p>I have tried to add the filter in tomcat web.xml by looking this link: <a href="http://enable-cors.org/server_tomcat.html" rel="nofollow noreferrer">http://enable-cors.org/server_tomcat.html</a></p>
  
  <p>It's Only working perfectly by using dev tool like curl and postman which has no Origin policy. But it's not working on the browser by Ajax. </p>
  
  <p>Please see the below filter class</p>
  
  <pre><code>public class SimpleCORSFilter implements Filter {
      public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
          HttpServletResponse response = (HttpServletResponse) res;
  System.out.println("test123");
          response.setHeader("Access-Control-Allow-Origin", "*");
          response.setHeader("Access-Control-Allow-Credentials", "true");
          response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
          response.setHeader("Access-Control-Max-Age", "3600");
          response.setHeader("Access-Control-Allow-Headers", "Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers");
          chain.doFilter(req, res);
      }
      public void init(FilterConfig filterConfig) {}
      public void destroy() {}
  }
  </code></pre>
  
  <p>I use the <code>System.out.println("test123");</code> in the filter, when using postman or curl, it printed the 'test123' in the console, but didn't print when using browser, so I guess the browser send the OPTIONS request, and the filter didn't intercept it, or other things intercept the request from browser first? </p>
  
  <p>Can anyone help me please? Thanks.</p>