title: Enable CORS for tomcat applications with credentials support
body: <p>I have a simple GWT application running from IIS on my server. I am trying to test HTTP requests to tomcat running on the same server. However, since both the application servers are running on different ports, my browser (chrome and firefox) treats the requests as a CORS request.</p>
  
  <p>To enable tomcat to accept CORS request, I updated it to Tomcat 7.0.52 and enabled the CORS filter in the global web.xml configuration. I tested this simple setup and it seems to work. Here is the code in GWT:</p>
  
  <pre><code>        String url = "http://bavarians:8080/";
          RequestBuilder rb = new RequestBuilder(RequestBuilder.GET, url);
          box.setText(url);
          try
          {
              rb.sendRequest("", new RequestCallback(){
  
                  @Override
                  public void onResponseReceived(Request request, Response response)
                  {
                      Window.alert(response.getStatusCode() + response.getStatusText());
                  }
  
                  @Override
                  public void onError(Request request, Throwable exception)
                  {
                      Window.alert("Request failed");
  
                  }});
          }
          catch (RequestException e)
          {
              // TODO Auto-generated catch block
              e.printStackTrace();
          }
  </code></pre>
  
  <p>Here is the CORS filter associated with it:</p>
  
  <pre><code>&lt;filter&gt;
    &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
    &lt;filter-class&gt;org.apache.catalina.filters.CorsFilter&lt;/filter-class&gt;
    &lt;init-param&gt;
      &lt;param-name&gt;cors.allowed.origins&lt;/param-name&gt;
      &lt;param-value&gt;http://bavarians&lt;/param-value&gt;
    &lt;/init-param&gt;
    &lt;init-param&gt;
      &lt;param-name&gt;cors.allowed.methods&lt;/param-name&gt;
      &lt;param-value&gt;GET,POST,HEAD,OPTIONS,PUT&lt;/param-value&gt;
    &lt;/init-param&gt;
    &lt;init-param&gt;
      &lt;param-name&gt;cors.allowed.headers&lt;/param-name&gt;
      &lt;param-value&gt;Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers, Authorization&lt;/param-value&gt;
    &lt;/init-param&gt;
    &lt;init-param&gt;
      &lt;param-name&gt;cors.exposed.headers&lt;/param-name&gt;
      &lt;param-value&gt;Access-Control-Allow-Origin,Access-Control-Allow-Credentials, Authorization&lt;/param-value&gt;
    &lt;/init-param&gt;
    &lt;init-param&gt;
      &lt;param-name&gt;cors.support.credentials&lt;/param-name&gt;
      &lt;param-value&gt;true&lt;/param-value&gt;
    &lt;/init-param&gt;
    &lt;init-param&gt;
      &lt;param-name&gt;cors.preflight.maxage&lt;/param-name&gt;
      &lt;param-value&gt;10&lt;/param-value&gt;
    &lt;/init-param&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
    &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
    &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>With this setup, I get a 200 OK response from tomcat. So its safe to assume that CORS filter is working. To back this up, I took a fiddler trace and all looked good.
  <img src="https://i.stack.imgur.com/XFwJH.jpg" alt="Fiddler trace with the above setup"></p>
  
  <p>Now, since I want to access one of the apps of tomcat(solr), I need basic authentication with my CORS request. This brings a preflight request into picture. Since I setup my CORS filter to enable credential use, I didn't need any changes to it. So, I made the following change to my code</p>
  
  <pre><code>        String url = "http://bavarians:8080/solr/select?wt=xml&amp;q=tag_name:abcd&amp;username=domain\\userid";
          RequestBuilder rb = new RequestBuilder(RequestBuilder.GET, url);
          box.setText(url);
          rb.setHeader("Authorization", "Basic YWRtaW46YWRtaW4=");
          rb.setIncludeCredentials(true);
  </code></pre>
  
  <p>Now, when I try to use this code, it gets inside the <code>onResponseReceived</code> code block and gives an alert box with "0" value. When I took a fiddler trace, I get this:</p>
  
  <p><img src="https://i.stack.imgur.com/h6lxs.jpg" alt="Fiddler trace with preflight request."></p>
  
  <p>It makes sense for the browser to send a preflight request since I am adding the custom header to the request. But I don't understand why tomcat responds with a 401 code despite adding the authorization header to its CORS filter configuration.</p>
  
  <p>I'd appreciate any help or response</p>
  
  <hr>
  
  <p><strong>EDIT:</strong> One more thing that I have noticed- if my URL is just "bavarians:8080/solr/";, tomcat successfully authorizes the preflighted request and the immediate next request is processed as a normal GET request with a 200 OK response. But if I enter the function name and query with the URL, I get 401 again. Accessing the above URL from browser requires Basic Authentication. So <code>CORSFilter</code> does work until some point</p>