Log in to create and rate content, and to follow, bookmark, and share content with other members. Not a member? Join Now!

AnsweredAssumed Answered

Configuring CORS for REST APIs

Question asked by rm0043949 on Nov 15, 2017
Latest reply on Nov 29, 2017 by rm0043949

Like • Show 0 Likes0
Comment • 6

Hi,

So far I've been unable to communicate with either our app servers or the Developer Virtual Machine from localhost (xampp) due to the CORS header and the Access-Control-Allow-Origin policy.

Unless I'm just really bad at searching, I haven't found any information that worked on configuring this correctly in Tomcat for the Developer VM.

Has anyone else run into this issue?

Ryan

No one else has this question

Outcomes

6 Replies

rm0043949 Nov 16, 2017 9:32 PM

Well, looks like I was able to resolve this by modifying Tomcat's web.xml file, located at %BB_HOME%/apps/tomcat/conf/web.xml

From Apache Tomcat 8 Configuration Reference (8.5.23) - Container Provided Filters

<filter>
  <filter-name>CorsFilter</filter-name>
  <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
  <init-param>
  <param-name>cors.allowed.origins</param-name>
  <param-value>*</param-value>
  </init-param>
  <init-param>
  <param-name>cors.allowed.methods</param-name>
  <param-value>GET,POST,HEAD,OPTIONS,PUT</param-value>
  </init-param>
  <init-param>
  <param-name>cors.allowed.headers</param-name>
  <param-value>Authorization, Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers</param-value>
  </init-param>
  <init-param>
  <param-name>cors.exposed.headers</param-name>
  <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>
  </init-param>
  <init-param>
  <param-name>cors.support.credentials</param-name>
  <param-value>true</param-value>
  </init-param>
  <init-param>
  <param-name>cors.preflight.maxage</param-name>
  <param-value>10</param-value>
  </init-param>
</filter>
<filter-mapping>
  <filter-name>CorsFilter</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

Based on the example I also had to add the "Authorization" header in cors.allowed.headers, and in a Production environment I wouldn't leave cors.allowed.origins as a wildcard - restrict that to only the server running your REST application. You may wish to add the DELETE and PATCH methods in order to use those APIs.

I'd still prefer it if I could configure this only for the REST API endpoints, rather than Tomcat as a whole. Our applications server are still fronted by Apache which I could do more advanced config in, but Blackboard supports the Tomcat-only approach.

Actions

scott.hurrey Nov 21, 2017 5:40 PM
Mark Correct
Correct Answer
Thanks for doing this work, Ryan. The Learn REST APIs don't support CORS at this time. You can get around this by building an API proxy, or as you have discovered, modifying the tomcat configuration if you have access. We are currently investigating the best way to handle AJAX-type requests.
Like • Show 0 Likes0
Actions
- rm0043949 @ scott.hurrey on Nov 21, 2017 5:48 PM
  Mark Correct
  Correct Answer
  Thanks Scott, good to know it's being looked at.
  
  I remember at DevCon in Darwin Australia you demonstrated the SignUp List which was built using the MEAN stack and I believe hosted on Heroku, so I assume that was using Angular's $http wrapper for AJAX. https://github.com/blackboard/BBDN-SignUp-List
  
  How did you work around this issue for the project? Does it contain an API proxy?
  Like • Show 0 Likes0
  Actions
  - scott.hurrey @ rm0043949 on Nov 29, 2017 2:15 PM
    Mark Correct
    Correct Answer
    In the SignUp List, the Learn calls are actually handled on the Node.JS backend. I did just this morning build a quick user sign up in Angular 2 to show how to use a proxy:
    
    GitHub - blackboard/BBDN-REST-Angular-WithProxy: A basic user signup in Angular 2 that retrieves a token via basic OAuth…
    
    I'll be writing up a blog to document this and why it is done and I'll attach it to the pending Authentication document that my colleague is working on.
    2 people found this helpful
    Like • Show 1 Like1
    Actions
    - scott.hurrey @ scott.hurrey on Nov 29, 2017 2:54 PM
      Mark Correct
      Correct Answer
      For a bit more information:
      
      Cross-Origin Resource Sharing; or Why I Can't Use AJAX with Learn APIs
      1 person found this helpful
      Like • Show 0 Likes0
      Actions
      - rm0043949 @ scott.hurrey on Nov 29, 2017 4:52 PM
        Mark Correct
        Correct Answer
        Thanks Scott, this is exactly the kind of document I was looking for when trying to work around this!
        Like • Show 0 Likes0
        Actions

Configuring CORS for REST APIs

Outcomes

Related Content

Recommended Content