title: Pentaho CDA: Basic Authentication and CORS conflict
body: <p>Working on a web app which queries Pentaho BI server 7 with a Tomcat 8 inside I'm facing some issues.</p>
  
  <p>First of all to avoid CORS (Cross-origin resource sharing) problems I have added the CORS filter inside the web.xml config file of the tomcat:</p>
  
  <pre><code>  &lt;filter&gt;
     &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
     &lt;filter-class&gt;org.apache.catalina.filters.CorsFilter&lt;/filter-class&gt;
      &lt;init-param&gt;
       &lt;param-name&gt;cors.allowed.headers&lt;/param-name&gt;
       &lt;param-value&gt;Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization&lt;/param-value&gt;
      &lt;/init-param&gt;   
   &lt;/filter&gt;
   &lt;filter-mapping&gt;
     &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
     &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
   &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>Afterwards, everything was fine until it was necessary to get some resources through Pentaho CDA (Pentaho Community Data Access). I've added a Basic Auth header and one line in the plugin settings file (pentaho-solutions/system/cda/settings.xml):</p>
  
  <pre><code>&lt;allow-cross-domain-resources&gt;true&lt;/allow-cross-domain-resources&gt;
  </code></pre>
  
  <p>Every request my aplication does gets the same error:</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load <a href="http://localhost:8080/pentaho/plugin/cda/api/doQuery?path=/whatever/dashboard.cda&amp;dataAccessId=mdxGetSmth" rel="nofollow noreferrer">http://localhost:8080/pentaho/plugin/cda/api/doQuery?path=/whatever/dashboard.cda&amp;dataAccessId=mdxGetSmth</a>. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '<a href="http://127.0.0.1:xxx" rel="nofollow noreferrer">http://127.0.0.1:xxx</a>' is therefore not allowed access. The response had HTTP status code 401.</p>
  </blockquote>
  
  <p>The funny thing is that the same query is working in Postman (of course with the same Basic auth header) just because Postman just jumps over the OPTIONS (preflight) request.</p>