title: Elastic Beanstalk CORS Configuration for Post Request
body: <p>I receive the following error when submitting a post request from my localhost - </p>
  
  <pre><code>XMLHttpRequest cannot load http://sample-env.elasticbeanstalk.com/resource 
  Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. 
  Origin 'http://localhost:8080' is therefore not allowed access
  </code></pre>
  
  <p>But, in the CORS configuration editor for my S3 instance, I have the following - </p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"&gt;
  &lt;CORSRule&gt;
      &lt;AllowedOrigin&gt;*&lt;/AllowedOrigin&gt;
      &lt;AllowedOrigin&gt;http://*&lt;/AllowedOrigin&gt;
      &lt;AllowedOrigin&gt;https://*&lt;/AllowedOrigin&gt;
      &lt;AllowedMethod&gt;GET&lt;/AllowedMethod&gt;
      &lt;AllowedMethod&gt;POST&lt;/AllowedMethod&gt;
      &lt;MaxAgeSeconds&gt;3000&lt;/MaxAgeSeconds&gt;
      &lt;AllowedHeader&gt;*&lt;/AllowedHeader&gt;
  &lt;/CORSRule&gt;
  </code></pre>
  
  <p></p>
  
  <p>I've played around with these three lines, but I'm still unable to diagnose the problem. </p>
  
  <pre><code>    &lt;AllowedOrigin&gt;*&lt;/AllowedOrigin&gt;
      &lt;AllowedOrigin&gt;http://*&lt;/AllowedOrigin&gt;
      &lt;AllowedOrigin&gt;https://*&lt;/AllowedOrigin&gt;
  </code></pre>
  
  <p>My developer console shows the following headers, which makes me think this CORS configuration isn't even being read - </p>
  
  <pre><code>HTTP/1.1 200 OK
  Date: Fri, 21 Apr 2017 02:48:01 GMT
  Server: Apache-Coyote/1.1
  Allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS
  Content-Length: 0
  Keep-Alive: timeout=60, max=98
  Connection: Keep-Alive
  Content-Type: text/plain
  </code></pre>
  
  <p>Does anyone see something wrong with my configurations or is there something else that must be added? I was able to add CORS filter to the web.xml of my tomcat and everything worked fine so I think I am configuring my elastic beanstalk incorrectly.</p>
  
  <p>EDIT</p>
  
  <p>Added the following .config file (formerly, .yaml)</p>
  
  <p>add_cors.config.config</p>
  
  <pre><code>files:
  "/etc/httpd/conf.d/cors.conf" :
      mode: "000644"
      owner: root
      group: root
      content: |
          &lt;Location "/"&gt;
              Header set Access-Control-Allow-Origin: *
              Header set Access-Control-Allow-Methods: "POST, GET, PUT, DELETE, OPTIONS"
              Header add Access-Control-Allow-Headers: "Authorization, Content-Type, Accept"
              Header set Access-Control-Allow-Credentials: true
  
              SetOutputFilter DEFLATE
          &lt;/Location&gt;
  </code></pre>
  
  <p>And it is in this location in the exploded war - </p>
  
  <pre><code>.
  ├── app.war
  ├── .ebextensions
  │   ├── add_cors.config.yaml
  ├── META-INF
  │   ├── …
  └── WEB-INF
      ├── classes
      │   └── …
      ├── servlet.xml
      ├── lib
      │   ├── …
      └── web.xml
  </code></pre>
  
  <p>I re-deployed the war, but I'm still having the same error - "No 'Access-Control-Allow-Origin' header is present"</p>
  
  <p>SOLUTION</p>
  
  <p>No .ebextensions files were necessary. I just needed to add the CORS filters to the web.xml like I had in my tomcat's conf/web.xml</p>
  
  <pre><code>  &lt;!-- ================== CORS FILTERS ===================== --&gt;
    &lt;filter&gt;
      &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
      &lt;filter-class&gt;org.apache.catalina.filters.CorsFilter&lt;/filter-class&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;cors.allowed.origins&lt;/param-name&gt;
        &lt;param-value&gt;*&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;cors.allowed.methods&lt;/param-name&gt;
        &lt;param-value&gt;GET,POST,HEAD,OPTIONS&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;cors.allowed.headers&lt;/param-name&gt;
        &lt;param-value&gt;Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;cors.exposed.headers&lt;/param-name&gt;
        &lt;param-value&gt;Access-Control-Allow-Origin,Access-Control-Allow-Credentials&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;cors.support.credentials&lt;/param-name&gt;
        &lt;param-value&gt;true&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;cors.preflight.maxage&lt;/param-name&gt;
        &lt;param-value&gt;10&lt;/param-value&gt;
      &lt;/init-param&gt;
    &lt;/filter&gt;
    &lt;filter-mapping&gt;
      &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
    &lt;/filter-mapping&gt;
  </code></pre>