Otdfbt

Sci fi short story, robot city that nags people about health

How does a blind passenger not die, if driver becomes unconscious

How long would it take to cross the Channel in 1890's?

Should developer taking test phones home or put in office?

How do I set an alias to a terminal line?

What's currently blocking the construction of the wall between Mexico and the US?

Is adding a new player (or players) a DM decision, or a group decision?

How to get cool night-vision without lame drawbacks?

Find the probability that the 8th woman to appear is in 17th position.

Inverse-quotes-quine

How to split an equation in two lines?

Can White Castle?

Employer wants to use my work email account after I quit

The Target Principal Name Is Incorrect. Cannot Generate SSPI Context (SQL or AD Issue)?

How dangerous are set-size assumptions?

What is the mechanical difference between the Spectator's Create Food and Water action and the Banshee's Undead Nature Trait?

Can any NP-Complete Problem be solved using at most polynomial space (but while using exponential time?)

Intuition for capacitors in series

How would modern naval warfare have to have developed differently for battleships to still be relevant in the 21st century?

Should my manager be aware of private LinkedIn approaches I receive? How to politely have this happen?

Why do textbooks often include the solutions to odd or even numbered problems but not both?

How would a drone work in centrifugal force generated "gravity"?

Impossible darts scores

Does Marvel have an equivalent of the Green Lantern?

Disable HTTP Authentication for OPTIONS requests in Tomcat

Disallowing HTTP methods on Tomcat is case sensitive?Disabling (Apache) Basic Authentication for OPTIONS requestsApache, Tomcat 5 and problem with HTTP basic authVarnish caching apache using address based Basic AuthenticationApache authenticate group of matching subdirectoryIIS aborting REST API CORS requests with status 500… for only one URIAccess-Control-Allow-Origin “*” not allowed when credentials flag is trueDisable authentication for HTTP OPTIONS method (preflight request)304 with CORS on apacheDisable authorisation on preflight OPTIONS request in HAProxyTomcat behind nginx proxy provides new jsessionids for each requestDisabling (Apache) Basic Authentication for OPTIONS requests

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;

2

I have an API protected by HTTP Basic Authentication.

When I want to make AJAX requests against the API, the browser send an OPTIONS request which doesn't carry the Authorization header so it gets rejected and thus my AJAX call is not allowed by the browser.

I tried to configure Tomcat to not authenticate OPTIONS requests but I've not managed to get it to work.

How can I disable HTTP Auth for OPTIONS requests in Tomcat?

tomcat authentication ajax cors

share|improve this question

edited Jun 6 at 20:38

MrWhite

6,69622 gold badges1414 silver badges2626 bronze badges

asked Oct 1 '15 at 9:37

OyoKooNOyoKooN

1822 silver badges66 bronze badges

add a comment | 

2

I have an API protected by HTTP Basic Authentication.

When I want to make AJAX requests against the API, the browser send an OPTIONS request which doesn't carry the Authorization header so it gets rejected and thus my AJAX call is not allowed by the browser.

I tried to configure Tomcat to not authenticate OPTIONS requests but I've not managed to get it to work.

How can I disable HTTP Auth for OPTIONS requests in Tomcat?

tomcat authentication ajax cors

share|improve this question

edited Jun 6 at 20:38

MrWhite

6,69622 gold badges1414 silver badges2626 bronze badges

asked Oct 1 '15 at 9:37

OyoKooNOyoKooN

1822 silver badges66 bronze badges

add a comment | 

I have an API protected by HTTP Basic Authentication.

When I want to make AJAX requests against the API, the browser send an OPTIONS request which doesn't carry the Authorization header so it gets rejected and thus my AJAX call is not allowed by the browser.

I tried to configure Tomcat to not authenticate OPTIONS requests but I've not managed to get it to work.

How can I disable HTTP Auth for OPTIONS requests in Tomcat?

tomcat authentication ajax cors

share|improve this question

edited Jun 6 at 20:38

MrWhite

6,69622 gold badges1414 silver badges2626 bronze badges

asked Oct 1 '15 at 9:37

OyoKooNOyoKooN

1822 silver badges66 bronze badges

share|improve this question

edited Jun 6 at 20:38

MrWhite

6,69622 gold badges1414 silver badges2626 bronze badges

asked Oct 1 '15 at 9:37

OyoKooNOyoKooN

1822 silver badges66 bronze badges

share|improve this question

edited Jun 6 at 20:38

MrWhite

6,69622 gold badges1414 silver badges2626 bronze badges

asked Oct 1 '15 at 9:37

OyoKooNOyoKooN

1822 silver badges66 bronze badges

edited Jun 6 at 20:38

MrWhite

6,69622 gold badges1414 silver badges2626 bronze badges

edited Jun 6 at 20:38

MrWhite

6,69622 gold badges1414 silver badges2626 bronze badges

asked Oct 1 '15 at 9:37

OyoKooNOyoKooN

1822 silver badges66 bronze badges

asked Oct 1 '15 at 9:37

OyoKooNOyoKooN

1822 silver badges66 bronze badges

2 Answers
2

active

oldest

votes

1

Maybe this answer will help. In short, we have to configure Tomcat server to forward the request to the CorsFilter even when unauthenticated, using something like this:

<security-constraint>
 <web-resource-collection>
 <url-pattern>/*</url-pattern>
 <http-method>OPTIONS</http-method>
 </web-resource-collection>
 <!-- no auth-constraint here -->
</security-constraint>

make sure you DON'T include the "auth-constraint" element. So, the following example will NOT WORK:

<security-constraint>
 <web-resource-collection>
 <url-pattern>/*</url-pattern>
 <http-method>OPTIONS</http-method>
 </web-resource-collection>
 <auth-constraint/><!-- this will prevent OPTIONS request -->
</security-constraint>

share|improve this answer

answered Aug 17 '18 at 10:21

Mladen B.Mladen B.

17611 silver badge33 bronze badges

add a comment | 

0

you must write a white list for your porpose

for more info see : Disallowing HTTP methods on Tomcat is case sensitive?

share|improve this answer

edited Apr 13 '17 at 12:14

Community♦

1

answered Oct 1 '15 at 10:15

mohammad moeinimohammad moeini

10111 bronze badge

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Hi, I don't see how this can help me with my issue.
  
  – OyoKooN
  Oct 1 '15 at 10:39
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f725988%2fdisable-http-authentication-for-options-requests-in-tomcat%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

1

Maybe this answer will help. In short, we have to configure Tomcat server to forward the request to the CorsFilter even when unauthenticated, using something like this:

<security-constraint>
 <web-resource-collection>
 <url-pattern>/*</url-pattern>
 <http-method>OPTIONS</http-method>
 </web-resource-collection>
 <!-- no auth-constraint here -->
</security-constraint>

make sure you DON'T include the "auth-constraint" element. So, the following example will NOT WORK:

<security-constraint>
 <web-resource-collection>
 <url-pattern>/*</url-pattern>
 <http-method>OPTIONS</http-method>
 </web-resource-collection>
 <auth-constraint/><!-- this will prevent OPTIONS request -->
</security-constraint>

share|improve this answer

answered Aug 17 '18 at 10:21

Mladen B.Mladen B.

17611 silver badge33 bronze badges

add a comment | 

1

Maybe this answer will help. In short, we have to configure Tomcat server to forward the request to the CorsFilter even when unauthenticated, using something like this:

<security-constraint>
 <web-resource-collection>
 <url-pattern>/*</url-pattern>
 <http-method>OPTIONS</http-method>
 </web-resource-collection>
 <!-- no auth-constraint here -->
</security-constraint>

make sure you DON'T include the "auth-constraint" element. So, the following example will NOT WORK:

<security-constraint>
 <web-resource-collection>
 <url-pattern>/*</url-pattern>
 <http-method>OPTIONS</http-method>
 </web-resource-collection>
 <auth-constraint/><!-- this will prevent OPTIONS request -->
</security-constraint>

share|improve this answer

answered Aug 17 '18 at 10:21

Mladen B.Mladen B.

17611 silver badge33 bronze badges

add a comment | 

Maybe this answer will help. In short, we have to configure Tomcat server to forward the request to the CorsFilter even when unauthenticated, using something like this:

<security-constraint>
 <web-resource-collection>
 <url-pattern>/*</url-pattern>
 <http-method>OPTIONS</http-method>
 </web-resource-collection>
 <!-- no auth-constraint here -->
</security-constraint>

make sure you DON'T include the "auth-constraint" element. So, the following example will NOT WORK:

<security-constraint>
 <web-resource-collection>
 <url-pattern>/*</url-pattern>
 <http-method>OPTIONS</http-method>
 </web-resource-collection>
 <auth-constraint/><!-- this will prevent OPTIONS request -->
</security-constraint>

share|improve this answer

answered Aug 17 '18 at 10:21

Mladen B.Mladen B.

17611 silver badge33 bronze badges

<security-constraint>
 <web-resource-collection>
 <url-pattern>/*</url-pattern>
 <http-method>OPTIONS</http-method>
 </web-resource-collection>
 <!-- no auth-constraint here -->
</security-constraint>

<security-constraint>
 <web-resource-collection>
 <url-pattern>/*</url-pattern>
 <http-method>OPTIONS</http-method>
 </web-resource-collection>
 <auth-constraint/><!-- this will prevent OPTIONS request -->
</security-constraint>

share|improve this answer

answered Aug 17 '18 at 10:21

Mladen B.Mladen B.

17611 silver badge33 bronze badges

answered Aug 17 '18 at 10:21

Mladen B.Mladen B.

17611 silver badge33 bronze badges

answered Aug 17 '18 at 10:21

Mladen B.Mladen B.

17611 silver badge33 bronze badges

0

you must write a white list for your porpose

for more info see : Disallowing HTTP methods on Tomcat is case sensitive?

share|improve this answer

edited Apr 13 '17 at 12:14

Community♦

1

answered Oct 1 '15 at 10:15

mohammad moeinimohammad moeini

10111 bronze badge

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Hi, I don't see how this can help me with my issue.
  
  – OyoKooN
  Oct 1 '15 at 10:39
  

  
  
  
  

add a comment | 

0

you must write a white list for your porpose

for more info see : Disallowing HTTP methods on Tomcat is case sensitive?

share|improve this answer

edited Apr 13 '17 at 12:14

Community♦

1

answered Oct 1 '15 at 10:15

mohammad moeinimohammad moeini

10111 bronze badge

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Hi, I don't see how this can help me with my issue.
  
  – OyoKooN
  Oct 1 '15 at 10:39
  

  
  
  
  

add a comment | 

you must write a white list for your porpose

for more info see : Disallowing HTTP methods on Tomcat is case sensitive?

share|improve this answer

edited Apr 13 '17 at 12:14

Community♦

1

answered Oct 1 '15 at 10:15

mohammad moeinimohammad moeini

10111 bronze badge

share|improve this answer

edited Apr 13 '17 at 12:14

Community♦

1

answered Oct 1 '15 at 10:15

mohammad moeinimohammad moeini

10111 bronze badge

edited Apr 13 '17 at 12:14

Community♦

1

edited Apr 13 '17 at 12:14

Community♦

1

answered Oct 1 '15 at 10:15

mohammad moeinimohammad moeini

10111 bronze badge

answered Oct 1 '15 at 10:15

mohammad moeinimohammad moeini

10111 bronze badge