How to enable Cross domain requests on JAX-RS web services?

by

I was wondering the same thing, so after a bit of research I found that the easiest way was simply to use a JAX-RS ContainerResponseFilter to add the relevant CORS headers. This way you don’t need to replace the whole web services stack with CXF (Wildfly uses CXF is some form, but it doesn’t look like it uses it for JAX-RS maybe only JAX-WS).

Regardless if you use this filter it will add the headers to every REST webservice.

package com.yourdomain.package;

import java.io.IOException;

import javax.ws.rs.container.ContainerRequestContext;
import javax.ws.rs.container.ContainerResponseContext;
import javax.ws.rs.container.ContainerResponseFilter;
import javax.ws.rs.ext.Provider;

@Provider
public class CORSFilter implements ContainerResponseFilter {

   @Override
   public void filter(final ContainerRequestContext requestContext,
                      final ContainerResponseContext cres) throws IOException {
      cres.getHeaders().add("Access-Control-Allow-Origin", "*");
      cres.getHeaders().add("Access-Control-Allow-Headers", "origin, content-type, accept, authorization");
      cres.getHeaders().add("Access-Control-Allow-Credentials", "true");
      cres.getHeaders().add("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS, HEAD");
      cres.getHeaders().add("Access-Control-Max-Age", "1209600");
   }

}

Then when I tested with curl, the response had the CORS headers:

$ curl -D - "http://localhost:8080/rest/test"
HTTP/1.1 200 OK
X-Powered-By: Undertow 1
Access-Control-Allow-Headers: origin, content-type, accept, authorization
Server: Wildfly 8
Date: Tue, 13 May 2014 12:30:00 GMT
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Max-Age: 1209600
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS, HEAD

My understanding is that it’s the @Provider annotation that tells the JAX-RS runtime to use the filter, without the annotation nothing happens.

I got the idea about using the ContainerResponseFilter from a Jersey example.

More Related Contents:

  1. Access-Control-Allow-Origin Multiple Origin Domains?
  2. How to handle CORS using JAX-RS with Jersey
  3. How to resolve ‘preflight is invalid (redirect)’ or ‘redirect is not allowed for a preflight request’
  4. How to enable CORS in ASP.net Core WebAPI
  5. Same origin Policy and CORS (Cross-origin resource sharing)
  6. Access-Control-Allow-Origin wildcard subdomains, ports and protocols
  7. What is an opaque response, and what purpose does it serve?
  8. XMLHttpRequest cannot load an URL with jQuery
  9. How to create cross-domain request?
  10. CORS error on same domain?
  11. Firefox ‘Cross-Origin Request Blocked’ despite headers [closed]
  12. Understanding AJAX CORS and security considerations
  13. CORS not working php
  14. What are the integrity and crossorigin attributes?
  15. How to enable cross-origin resource sharing (CORS) in the express.js framework on node.js
  16. Adding Access-Control-Allow-Origin header response in Laravel 5.3 Passport
  17. Cross-Domain AJAX doesn’t send X-Requested-With header
  18. Is CORS a secure way to do cross-domain AJAX requests?
  19. CORS support for PUT and DELETE with ASP.NET Web API
  20. Problems Resteasy 3.09 CorsFilter
  21. Canvas tainted by cross-origin data
  22. same-origin policy and CORS – what’s the point?
  23. Disable cross domain web security in Firefox
  24. Javascript module not working in browser?
  25. How do I use Access-Control-Allow-Origin? Does it just go in between the html head tags?
  26. Why are CORS requests failing in Microsoft Edge but working in other browsers?
  27. Cross-domain connection in Socket.IO
  28. Enable CORS in Golang
  29. Internet Explorer 11 does not add the Origin header on a CORS request?
  30. Can Cross-Origin Resource Sharing headers authorize X-Domain IFRAME access?

Leave a Comment