title: Java JAX-RS CORS/Tomcat Conflict : javax.servlet.ServletException
body: <p>I am currently running my own web-app and it usually does not give me any issues to set up my environment. However, this is a new machine set up with Tomcat 9.0 and JDK 8. Only difference between this one and others which work properly is the version of Eclipse IDE.</p>
  
  <p>All resources return 404 in this environment and I have narrowed down the reason for this during runtime to:</p>
  
  <blockquote>
    <p>javax.servlet.ServletException: It is not allowed to configure supportsCredentials=[true] when allowedOrigins=[*]</p>
  </blockquote>
  
  <p>Anyone know why this is no longer allowed / why it does not work?</p>
  
  <p>In src/main/webapp/WEB-INF/web.xml CORS filters are added as follows:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;!-- This web.xml file is not required when using Servlet 3.0 container,
       see implementation details http://jersey.java.net/nonav/documentation/latest/jax-rs.html --&gt;
  &lt;web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;Jersey Web Application&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.glassfish.jersey.servlet.ServletContainer&lt;/servlet-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;jersey.config.server.provider.packages&lt;/param-name&gt;
              &lt;param-value&gt;lksecure.lks,lksecure,messenger.msg&lt;/param-value&gt;             
          &lt;/init-param&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;Jersey Web Application&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/webapi`/`*&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
    &lt;filter&gt;
      &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
      &lt;filter-class&gt;org.apache.catalina.filters.CorsFilter&lt;/filter-class&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;cors.allowed.origins&lt;/param-name&gt;
        &lt;param-value&gt;*&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;cors.allowed.methods&lt;/param-name&gt;
        &lt;param-value&gt;GET,POST,DELETE,HEAD,OPTIONS&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;cors.allowed.headers&lt;/param-name&gt;
        &lt;param-value&gt;Content-Type,auth,user,persona,target,recaptcha,id,endpoint,portX-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;cors.exposed.headers&lt;/param-name&gt;
        &lt;param-value&gt;Access-Control-Allow-Origin,Access-Control-Allow-Credentials&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;cors.support.credentials&lt;/param-name&gt;
        &lt;param-value&gt;true&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;cors.preflight.maxage&lt;/param-name&gt;
        &lt;param-value&gt;10&lt;/param-value&gt;
      &lt;/init-param&gt;
    &lt;/filter&gt;
    &lt;filter-mapping&gt;
      &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
    &lt;/filter-mapping&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>Thanks!</p>