I was able to modify tomcat's web.xml file with the following to allow cross domain requests:
<filter>
<filter-name>CorsFilter</filter-name>
<filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
<init-param>
<param-name>cors.allowed.origins</param-name>
<param-value>**Your Web App URL's here**
</param-value>
</init-param>
<init-param>
<param-name>cors.allowed.methods</param-name>
<param-value>GET,POST,HEAD,OPTIONS,PUT</param-value>
</init-param>
<init-param>
<param-name>cors.allowed.headers</param-name>
<param-value>Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization</param-value>
</init-param>
<init-param>
<param-name>cors.exposed.headers</param-name>
<param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>
</init-param>
<init-param>
<param-name>cors.support.credentials</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>cors.preflight.maxage</param-name>
<param-value>10</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>CorsFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
A few things to note:
- You can use "/*" to allow all domains/IP's to connect if you want
- If you have multiple items you wish to allow. Simply separate them by commas.( E.g. http://url.com,https://url.com)
- You must add your JSS URL/s to this list. Otherwise the web app will not load
- CORS sees different ports as a different origin, so you must be specifc. E.g. http://url.com and https://url.com are different.
- You must restart Tomcat to pick up the changes
As always, your mileage may vary and please reach out to your Account Manager to discuss any concerns with modifying this file. Also before making any changes makes sure to backup your Web.xml config file! Should something go wrong, it is easy to replace the original file and restart tomcat.
W3C's Info on CORS support: http://www.w3.org/wiki/CORS_Enabled
