对预检请求的响应未通过访问控制检查：不存在“Access-Control-Allow-Origin”标头。 服务器错误

Question

I am using angular js in frontend and java hibernate at backend. My website worked perfectly fine a few days ago but recently I made some changes in the table structure. After those changes when i tried to integrate angular js I faced with the following error message.

XMLHttpRequest cannot load localhost:8080/SignInMainServlet. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'localhost:3000' is therefore not allowed access.

I read a bit about preflight request and header permissions but all possible solutions failed.

I have a index page which has some get requests and are working perfectly fine when I initially load the page or refresh it later. But as soon as I call the post request for SignInMainServlet the error pops up. After this when I refresh my page none of the get request works and shows the same error.

Here is my post request

return $http({
            method: 'POST',
            url: 'http://localhost:8080/SignInMainServlet',
            data: $httpParamSerializerJQLike({
                login_source: source,
                accessToken: code,
                referrer_code: referral_id
            }),
            headers: { 'Content-Type': 'application/x-www-form-urlencoded;charset=utf-8' }
        });

And the server side for his request is :

String referrer_code=request.getParameter("referrer_code");
String login_source=request.getParameter("login_source");
String accessToken=request.getParameter("accessToken");

SignInMainManager m = new SignInMainManager(accessToken, referrer_code, login_source,REFERRAL_CODE_COUNT);
String result = m.signIn();


response.setContentType("text/html");  

response.addHeader("Access-Control-Allow-Origin","*");
response.addHeader("Access-Control-Allow-Methods"," GET, POST, OPTIONS");
response.addHeader("Access-Control-Allow-Headers","Content-Type");

PrintWriter out = response.getWriter(); 


out.println(result);
out.close();//closing the stream 

I monitored the network while sending the request and gets the following:

General

Request URL:localhost:8080/SignInMainServlet Request Method:OPTIONS Status Code:200 OK Remote Address:127.0.0.1:8080

Response Headers

Allow:GET, HEAD, POST, TRACE, OPTIONS Content-Length:0 Date:Sun, 05 Feb 2017 10:49:56 GMT Server:Jetty(8.1.14.v20131031)

Request Headers

Accept: / Accept-Encoding:gzip, deflate, sdch, br Accept-Language:en-GB,en-US;q=0.8,en;q=0.6 Access-Control-Request-Headers:authorization Access-Control-Request-Method:POST Connection:keep-alive Host:localhost:8080 Origin:localhost:3000 Referer:localhost:3000/ User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36

Answer 1

I created this filter and now it's working with all requests.

package com.your.package;

import java.io.IOException;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletResponse;    

@WebFilter(asyncSupported = true, urlPatterns = { "/*" })
public class Filter implements javax.servlet.Filter {

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        ((HttpServletResponse) response).addHeader("Access-Control-Allow-Origin", "*");
        ((HttpServletResponse) response).addHeader("Access-Control-Allow-Methods", "GET, OPTIONS, HEAD, PUT, POST");
        ((HttpServletResponse) response).addHeader("Access-Control-Allow-Headers", "Content-Type");
        ((HttpServletResponse) response).addHeader("Access-Control-Max-Age", "86400");
        // pass the request along the filter chain
        chain.doFilter(request, response);
    }

    public void init(FilterConfig fConfig) throws ServletException {
        // TODO Auto-generated method stub
    }

    @Override
    public void destroy() {
        // TODO Auto-generated method stub
    }
}

If you're using a web.xml you can follow this. https://amodernstory.com/2014/12/27/using-cors-headers-with-java-example/