title: Tomcat 8.5 - Error 403 Forbidden or empty params on POST request
body: <p>My web application consists of a html page which submits data to a java servlet that generates a pdf file from it.
  On local testing and the test server everything worked fine, but since I use the production server, which is mapped to a registered subdomain together with a certificate and use of https, I got error <code>403 - Forbidden You don't have permission to access /Project/servlet on this server</code>. The html will be included in a different website on a different machine than the tomcat server.</p>
  
  <p><strong>How could I allow access to the servlet?</strong></p>
  
  <p>Edit:
  I tried to submit the form via JavaScript, this gives me no 403 error but status code 200, but sends an empty request body - with no parameters which is pretty useless.</p>
  
  <pre><code>let xhr = new XMLHttpRequest();
  const url = serverpath + "/servlet";
   xhr.onreadystatechange = function() {
      if (xhr.readyState === 4) {
          window.open(xhr.response);
      }
  }
  
  xhr.open("POST", url, true);
  xhr.setRequestHeader('Content-Type', 'application/json');
  
  xhr.send(JSON.stringify({
      value1: "1",
      value2: "2",
      value3: "3"
   }));
  </code></pre>
  
  <p>When using <code>xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded; charset=UTF-8');</code> instead and sending in form of <code>xhr.send('value1='1'&amp;value2='2'+'&amp;value3='3');</code> it's back on error 403 Forbidden.</p>
  
  <p>Here is my web.xml of the project:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns="http://xmlns.jcp.org/xml/ns/javaee"
      xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
      id="WebApp_ID" version="3.1"&gt;
      &lt;display-name&gt;StaticsCalculator&lt;/display-name&gt;
      &lt;welcome-file-list&gt;
          &lt;welcome-file&gt;html/htmlpage.html&lt;/welcome-file&gt;
          &lt;welcome-file&gt;servlet&lt;/welcome-file&gt;
      &lt;/welcome-file-list&gt;
  &lt;filter&gt;
          &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
          &lt;filter-class&gt;org.apache.catalina.filters.CorsFilter&lt;/filter-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;cors.allowed.origins&lt;/param-name&gt;
              &lt;param-value&gt;*&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;cors.allowed.methods&lt;/param-name&gt;
              &lt;param-value&gt;GET,POST,HEAD,OPTIONS,PUT&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;cors.allowed.headers&lt;/param-name&gt;
              &lt;param-value&gt;Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;cors.exposed.headers&lt;/param-name&gt;
              &lt;param-value&gt;Access-Control-Allow-Origin,Access-Control-Allow-Credentials&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;cors.preflight.maxage&lt;/param-name&gt;
              &lt;param-value&gt;10&lt;/param-value&gt;
          &lt;/init-param&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;log4jConfiguration&lt;/param-name&gt;
          &lt;param-value&gt;logging.xml&lt;/param-value&gt;
      &lt;/context-param&gt;
  &lt;/web-app&gt;
  </code></pre>