title: Apache Tomcat and CORS
body: <p>I'm working with a server and I am trying to do Cross Domain Scripting.</p>
  
  <p>I've tried to add <a href="http://software.dzhuvinov.com/cors-filter-installation.html" rel="nofollow">http://software.dzhuvinov.com/cors-filter-installation.html</a> and have placed the java file in .../tomcat/lib/ (and in .../tomcat/webapps/MYAPP/WEB-INF/lib/ because it wasn't working) and have modified web.xml to include...</p>
  
  <pre><code>&lt;servlet&gt;
      &lt;description&gt;Desciption&lt;/description&gt;
      &lt;display-name&gt;Displayname&lt;/display-name&gt;
      &lt;servlet-name&gt;myservlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;java.path&lt;/servlet-class&gt;
  &lt;/servlet&gt;
  
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;myservlet&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/wsdl&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  &lt;filter&gt;
       &lt;filter-name&gt;CORS&lt;/filter-name&gt;
       &lt;filter-class&gt;com.thetransactioncompany.cors.CORSFilter&lt;/filter-class&gt; 
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;CORS&lt;/filter-name&gt;
      &lt;servlet-name&gt;myservlet&lt;/servlet-name&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>And I restart the web server.</p>
  
  <p>I can't get the Access-Control-Allow-Origin to work. I keep getting 403 errors.</p>
  
  <p>I guess I must have not followed the 3 steps on the website correctly. Any ideas how to make it work?</p>
  
  <p>Thanks.</p>
  
  <p>Edit1: I declare my url and my soap message prior to this call as url, and soapMessage. I'm sure they are both well formed since they work fine in soapUI.</p>
  
  <p>The call is:</p>
  
  <pre><code>$.ajax({ 
      type: "POST",
          url: url,
          dataType: "xml",
          contentType: "text/xml",
          //crossDomain: true, 
          data: soapMessage,
          //xhrFields: {
          //  withCredentials: true
          //},
          success: function(data){ 
              var xml = data.xml;
              console.log("Success!");
              console.log(xml);
              //[do something with the xml] 
          }, 
          error: function(data){ 
              var xml = data.xml;
              console.log("Error!");
              console.log(xml);
              //[do something with the xml] 
          }, 
          complete: function(data){ 
              var xml = data.xml;
              console.log("Complete!");
              console.log(xml);
              //[do something with the xml] 
          }
  </code></pre>
  
  <p>I've been trying different fields with little luck. I'm not sure if it is of note, but when I don't include the dataType the response header indicates a the Access-Control-Allow-Origin I would want to see and returns a 415 Error (Unsupport Media Type).</p>
  
  <p>Example Request Header:</p>
  
  <pre><code>OPTIONS /servlet/wsdl?wsdl HTTP/1.1
  Host: otherserver:8080
  Connection: keep-alive
  Access-Control-Request-Method: POST
  Origin: thiswebpage.com
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.83 Safari/537.1
  Access-Control-Request-Headers: origin, content-type, accept
  Accept: */*
  Referer: thiswebpage.com/thisForm.cfm
  Accept-Encoding: gzip,deflate,sdch
  Accept-Language: en-US,en;q=0.8
  Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
  </code></pre>
  
  <p>Example Response Header:</p>
  
  <pre><code>HTTP/1.1 403 Forbidden
  Server: Apache-Coyote/1.1
  Content-Type: text/plain
  Content-Length: 86
  Date: Tue, 28 Aug 2012 13:12:04 GMT
  </code></pre>
  
  <p>There are other filters (the web.xml file is huge) but the only ones that could be effecting things are these. I'd need to go to the company which created the file since my boss will likely not let me touch these (I'm only an intern).</p>
  
  <pre><code>&lt;filter&gt;
      &lt;filter-name&gt;agentSecurityModeFilter&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;agentSecurityModeFilter&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>I'm not sure what they are doing here... it appears they are adding the same filter twice to the same url pattern with different names. </p>
  
  <p>Again, thanks!</p>