java - Enable CORS Apache Tomcat 7.0.52 -

this question has answer here:

• set cors header in tomcat 3 answers

i have been trying enable cors on microsoft azure apache tomcat server , have tried quite lot of techniques still unable cors , running. have added web.xml file , no luck in getting enabled.

<filter>   <filter-name>corsfilter</filter-name>   <filter-class>org.apache.catalina.filters.corsfilter</filter-class>   <init-param>     <param-name>cors.allowed.origins</param-name>     <param-value>*</param-value>   </init-param>   <init-param>     <param-name>cors.allowed.methods</param-name>     <param-value>get,post,head,options,put</param-value>   </init-param>   <init-param>     <param-name>cors.allowed.headers</param-name>     <param-value>content-type,x-requested-with,accept,origin,access-control-request-method,access-control-request-headers</param-value>   </init-param>   <init-param>     <param-name>cors.exposed.headers</param-name>     <param-value>access-control-allow-origin,access-control-allow-credentials</param-value>   </init-param>   <init-param>     <param-name>cors.support.credentials</param-name>     <param-value>true</param-value>   </init-param>   <init-param>     <param-name>cors.preflight.maxage</param-name>     <param-value>10</param-value>   </init-param> </filter> <filter-mapping>   <filter-name>corsfilter</filter-name>   <url-pattern>/*</url-pattern> </filter-mapping> 

i keep getting error:

xmlhttprequest cannot load url&output=json. no 'access-control-allow-origin' header present on requested resource. origin 'http://url.net' therefore not allowed access.

any suggestions on how can achieve quickly? have been looking @ loads of resources online , can't work unfortunately. looking forward suggestions.

your web.xml looks ok, i'm expecting set response header requested (your question doesn't make clear either way).

however on modern browsers (chrome, firefox etc.), you'll find won't allow wildcard origins:

<filter-class>org.apache.catalina.filters.corsfilter</filter-class> <init-param>     <param-name>cors.allowed.origins</param-name>     <param-value>*</param-value> </init-param> 

instead, you'll need specify expected domain, greater security:

<filter-class>org.apache.catalina.filters.corsfilter</filter-class> <init-param>     <param-name>cors.allowed.origins</param-name>     <param-value>http://otherdomain.com</param-value> </init-param> 

usefully, list of origins can comma separated:

a * can specified enable access resource origin. otherwise, whitelist of comma separated origins can provided. eg: http://www.w3.org, https://www.apache.org. defaults: * (any origin allowed access resource)

source: https://tomcat.apache.org/tomcat-7.0-doc/config/filter.html