title: How to enable cross-domain -CORS- request on Tomcat?
body: <p>Using Angularjs I want to access a Geoserver service that use Tomcat 7 as web server.But when I call this service the console browser shows this error:</p>
  
  <pre><code>XMLHttpRequest cannot load http://127.0.0.1:8080/geoserver/rest/workspaces. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://127.0.0.1:3000' is therefore not allowed access.
  </code></pre>
  
  <p>So To add CORS headers I added following lines to usr/share/geoserver/WEB-INF/web.xml:</p>
  
  <pre><code>&lt;filter&gt;
   &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
   &lt;filter-class&gt;org.apache.catalina.filters.CorsFilter&lt;/filter-class&gt;
   &lt;init-param&gt;
     &lt;param-name&gt;cors.allowed.origins&lt;/param-name&gt;
     &lt;param-value&gt;*&lt;/param-value&gt;
  &lt;/init-param&gt;
  &lt;/filter&gt;
     &lt;filter-mapping&gt;
  &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
  &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>After restarting server, same error shown by the console browser.
  So I changed above lines to these lines:</p>
  
  <pre><code>&lt;filter&gt;
  &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
  &lt;filter-class&gt;org.apache.catalina.filters.CorsFilter&lt;/filter-class&gt;
  &lt;init-param&gt;
     &lt;param-name&gt;cors.allowed.origins&lt;/param-name&gt;
     &lt;param-value&gt;*&lt;/param-value&gt;
  &lt;/init-param&gt;
  &lt;init-param&gt;
    &lt;param-name&gt;cors.allowed.methods&lt;/param-name&gt;
    &lt;param-value&gt;GET,POST,HEAD,OPTIONS,PUT&lt;/param-value&gt;
  &lt;/init-param&gt;
  &lt;init-param&gt;
    &lt;param-name&gt;cors.allowed.headers&lt;/param-name&gt;
    &lt;param-value&gt;Content-Type,X-Requested-With,accept,Origin,Access-  Control-Request-Method,Access-Control-Request-Headers&lt;/param-value&gt;
   &lt;/init-param&gt;
   &lt;init-param&gt;
     &lt;param-name&gt;cors.exposed.headers&lt;/param-name&gt;
     &lt;param-value&gt;Access-Control-Allow-Origin,Access-Control-Allow-Credentials&lt;/param-value&gt;
   &lt;/init-param&gt;
   &lt;init-param&gt;
      &lt;param-name&gt;cors.support.credentials&lt;/param-name&gt;
      &lt;param-value&gt;true&lt;/param-value&gt;
   &lt;/init-param&gt;
   &lt;init-param&gt;
      &lt;param-name&gt;cors.preflight.maxage&lt;/param-name&gt;
      &lt;param-value&gt;10&lt;/param-value&gt;
   &lt;/init-param&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
    &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
    &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>And this time error was:</p>
  
  <pre><code>OPTIONS http://127.0.0.1:8080/geoserver/rest/workspaces 
  (index):1 XMLHttpRequest cannot load    http://127.0.0.1:8080/geoserver/rest/workspaces. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://127.0.0.1:3000' is therefore not allowed access. The response had HTTP status code 403.
  </code></pre>
  
  <p>Response header is:</p>
  
  <pre><code>**General**
     Remote Address:127.0.0.1:8080
     Request URL:http://127.0.0.1:8080/geoserver/rest/workspaces
     Request Method:OPTIONS
     Status Code:403 Forbidden
  
  **Response Headers**
     Content-Length:0
     Content-Type:text/plain
     Date:Mon, 27 Jul 2015 05:57:17 GMT
     Server:Apache-Coyote/1.1
  
  **Request headers**
     Accept:*/*
     Accept-Encoding:gzip, deflate, sdch
     Accept-Language:en-US,en;q=0.8
     Access-Control-Request-Headers:accept, access-control-allow-methods
     Access-Control-Request-Method:GET
     Cache-Control:max-age=0
     Connection:keep-alive
     Host:127.0.0.1:8080
     Origin:http://127.0.0.1:3000
     Referer:http://127.0.0.1:3000/
     User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36     (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
  </code></pre>
  
  <p>I read many explanations on the Internet, but nothing seems to work and I don't know what I am doing wrong.</p>