title: Adding response header in Tomcat
body: <p>I have a GeoServer application, running on top of Tomcat. What I want is to set one extra response header - Access-Control-Allow-Origin: *. I need this because now I cannot implement on feature in my map application, since in browser I get </p>
  
  <blockquote>
    <p>The operation is insecure</p>
  </blockquote>
  
  <p>message</p>
  
  <p>According to <a href="https://stackoverflow.com/questions/25753754/canvas-todataurl-security-error-the-operation-is-insecure">this</a> thread, I need to set this header: <code>"Access-Control-Allow-Origin: *"</code> and according to <a href="https://stackoverflow.com/questions/16296145/set-cors-header-in-tomcat">this</a> thread in Tomcat I can set it via CATALINA_HOME/conf/web.xml:</p>
  
  <pre><code>&lt;filter&gt;
     &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
     &lt;filter-class&gt;org.apache.catalina.filters.CorsFilter&lt;/filter-class&gt;
   &lt;/filter&gt;
   &lt;filter-mapping&gt;
     &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
     &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
   &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>I did exatly that, restarted the Tomcat, but still I do not see that header in response. This what server responds to the client:</p>
  
  <p><a href="https://i.stack.imgur.com/TIgbD.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/TIgbD.png" alt="enter image description here"></a></p>
  
  <p>So, how can I fix it? How can I force my GeoServer application (third party application) to respond with <code>"Access-Control-Allow-Origin: *"</code> ?</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>I should add, that I'm using Tomcat 8. Besides, my filter now looks like:</p>
  
  <pre><code>&lt;filter&gt;
    &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
    &lt;filter-class&gt;org.apache.catalina.filters.CorsFilter&lt;/filter-class&gt;
    &lt;init-param&gt;
    &lt;param-name&gt;cors.allowed.origins&lt;/param-name&gt;
    &lt;param-value&gt;*&lt;/param-value&gt;
    &lt;/init-param&gt;
    &lt;init-param&gt;
    &lt;param-name&gt;cors.allowed.methods&lt;/param-name&gt;
    &lt;param-value&gt;GET,POST,HEAD,OPTIONS,PUT&lt;/param-value&gt;
    &lt;/init-param&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
   &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
   &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>I added this filter both to the main web.xml and to the web.xml of the application, but to no avail. So, it seems like all previous solutions to this problem are outdated.</p>