title: Getting cors errors in Scala Play Framework v2.6.x
body: <p>I'm trying to get around a CORS error for a simple "hello world" style REST API in Scala/Play 2.6.x and I have tried everything that I can think of at this point. As far as I can tell there is not a good solution or example to be found on the internet, so even if this should be an easy fix then anyone that has a good solution would really help me out by posting it in full. I am simply trying to send a post request from <code>localhost:3000</code> (a react application using axios) to <code>localhost:9000</code> where my Scala/Play framework lives.</p>
  
  <p><strong>THE ERRORS</strong></p>
  
  <p>The error that I am getting on the client-side is the following: </p>
  
  <pre><code>XMLHttpRequest cannot load http://localhost:9000/saveTest.
  Response to preflight request doesn't pass access control check:
  No 'Access-Control-Allow-Origin' header is present on the requested
  resource. Origin 'http://localhost:3000' is therefore not allowed
  access. The response had HTTP status code 403.
  </code></pre>
  
  <p>The error that I am getting on the server-side is</p>
  
  <pre><code>success] Compiled in 1s
  
  --- (RELOAD) ---
  
  [info] p.a.h.EnabledFilters - Enabled Filters
  (see &lt;https://www.playframework.com/documentation/latest/Filters&gt;):
  
      play.filters.csrf.CSRFFilter
      play.filters.headers.SecurityHeadersFilter
      play.filters.hosts.AllowedHostsFilter
      play.filters.cors.CORSFilter
  
  [info] play.api.Play - Application started (Dev)
  [warn] p.f.c.CORSFilter - Invalid CORS
  request;Origin=Some(http://localhost:3000);
  Method=OPTIONS;Access-Control-Request-Headers=Some(content-type)
  </code></pre>
  
  <p><strong>MY CODE</strong></p>
  
  <p>I have the following in my <code>application.conf</code> file</p>
  
  <pre><code># https://www.playframework.com/documentation/latest/Configuration
  
  play.filters.enabled += "play.filters.cors.CORSFilter"
  
  play.filters.cors {
    pathPrefixes = ["/"]
    allowedOrigins = ["http://localhost:3000", ...]
    allowedHttpMethods = ["GET", "POST", "PUT", "DELETE"]
    allowedHttpHeaders = ["Accept"]
    preflightMaxAge = 3 days
  }
  </code></pre>
  
  <p>I've tried changing <code>pathPrefixes</code> to <code>/saveTest</code> (my endpoint), and tried changing <code>allowedOrigins</code> to simply <code>'https://localhost'</code>. I've tried changing <code>allowedHttpHeaders="Allow-access-control-allow-origin"</code>. I've tried setting <code>allowedOrigins</code>, <code>allowedHttpMethods</code>, and <code>allowedHttpHeaders</code> all to null which, according to the documentation (<a href="https://www.playframework.com/documentation/2.6.x/resources/confs/filters-helpers/reference.conf" rel="noreferrer">https://www.playframework.com/documentation/2.6.x/resources/confs/filters-helpers/reference.conf</a>) should allow everything (as should <code>pathPrefixes=["/"]</code></p>
  
  <p>My build.sbt is the following, so it should be adding the filter to the libraryDependencies: </p>
  
  <pre><code>name := """scalaREST"""
  organization := "com.example"
  
  version := "1.0-SNAPSHOT"
  
  lazy val root = (project in file(".")).enablePlugins(PlayScala)
  
  scalaVersion := "2.12.2"
  
  libraryDependencies += guice
  libraryDependencies += "org.scalatestplus.play" %% "scalatestplus-play" % "3.1.0" % Test
  libraryDependencies += filters
  </code></pre>
  
  <p>According to documentation available here: <a href="https://www.playframework.com/documentation/2.6.x/Filters#default-filters" rel="noreferrer">https://www.playframework.com/documentation/2.6.x/Filters#default-filters</a> you can set the default filters like this:</p>
  
  <pre><code>import javax.inject.Inject
  
  import play.filters.cors.CORSFilter
  import play.api.http.{ DefaultHttpFilters, EnabledFilters }
  
  class Filters @Inject()(enabledFilters: EnabledFilters, corsFilter: CORSFilter)
    extends DefaultHttpFilters(enabledFilters.filters :+ corsFilter: _*)
  </code></pre>
  
  <p>I'm not sure exactly where that should go in my project - it doesn't say, but from other stackoverflow answers I kind of assume it should go in the root of my directory (that is <code>/app</code>). So that's where I put it.</p>
  
  <p>Finally, there was one exotic stackoverflow response that said to put this class in my controllers and add it as a function to my OK responses</p>
  
  <pre><code>  implicit class RichResult (result: Result) {
      def enableCors =  result.withHeaders(
        "Access-Control-Allow-Origin" -&gt; "*"
        , "Access-Control-Allow-Methods" -&gt; 
          "OPTIONS, GET, POST, PUT, DELETE, HEAD"
          // OPTIONS for pre-flight
        , "Access-Control-Allow-Headers" -&gt; 
          "Accept, Content-Type, Origin, X-Json, 
          X-Prototype-Version, X-Requested-With"
          //, "X-My-NonStd-Option"
        , "Access-Control-Allow-Credentials" -&gt; "true"
      )
    }
  </code></pre>
  
  <p>Needless to say, this did not work.</p>
  
  <p><strong>WRAP UP</strong></p>
  
  <p>Here is the backend for my current scala project. </p>
  
  <p><a href="https://github.com/patientplatypus/scalaproject1/tree/master/scalarest" rel="noreferrer">https://github.com/patientplatypus/scalaproject1/tree/master/scalarest</a></p>
  
  <p>Please, if you can, show a full working example of a CORS implementation - I cannot get anything I can find online to work. I will probably be submitting this as a documentation request to the Play Framework organization - this should not be nearly this difficult. Thank you.</p>