OData plugin and CORS

[matcho]

Hello,

Enabling CORS with http.cors.enable works for all /v1.1 routes, but does not seem to affect /ODATA_4.0/* routes.

Tried to enable CorsFilter in web.xml, even to move this config block to global Tomcat web.xml as suggested in the comments. No success.

Is there some special way to enable CORS for OData routes ?

Thank you
Mathias

[hylkevds]

That's odd, since the filter is added to /*:

FROST-Server/FROST-Server.HTTP.Common/src/main/java/de/fraunhofer/iosb/ilt/frostserver/http/common/AbstractContextListener.java

Line 112 in 616eb28

corsFilter.addMappingForUrlPatterns(EnumSet.of(DispatcherType.REQUEST, DispatcherType.FORWARD), true, "/*");

If you move the filter to Web.xml, make sure you disable the one in FROST.

[hylkevds]

Also important for CORS: You can't use an allowed origins setting of * when also using authentication. So if you use authentication you must specify each allowed origin explicitly.

And when using authentication from a browser, the javascript must set XMLHttpRequest.withCredentials to true on the request, otherwise the credentials are not sent to the server.