I have created a jax-rs restful service using cxf and annotated my scala service implementation to expose cors headers:
@Path("/foo/{date}")
@Produces(Array("application/xml"))
@CrossOriginResourceSharing(allowAllOrigins = true)
class Foo {
@GET
@Path("{id}")
def doStuff(@PathParam("date") date: util.Date, @PathParam("id") id: Int) = ...
}
In my Spring applicationContext.xml I have registered a cors filter within the jaxrs:providers
list
<bean id="corsFilter" class="org.apache.cxf.rs.security.cors.CrossOriginResourceSharingFilter"
p:allowCredentials="true"/>
I can happily use the endpoint directly from Firefox/IE via http://localhost:8080/foo/2012-07-17/123
but I am trying to build a service which will be invoked from another web application in order to decouple the two.
When I make the request directly through Firefox I see the following:
Response Headers
Content-Length 5699
Content-Type application/xml
Date Wed, 18 Jul 2012 16:49:09 GMT
Server Apache-Coyote/1.1
Request Headers
Accept text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding gzip, deflate
Accept-Language en-us,en;q=0.5
Cache-Control max-age=0
Connection keep-alive
Cookie DWRSESSIONID=Q62Vf$dv*S9sA8EaJm6jKW6$pyj; JSESSIONID=17E120C419F075B505447F151124BC18
Host localhost:9580
User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1
And when I make the request via Ajax from a webpage on my local disk I see the following:
Response Headers
Access-Control-Allow-Cred... true
Access-Control-Allow-Orig... *
Content-Length 6177
Content-Type application/xml
Date Wed, 18 Jul 2012 16:41:21 GMT
Server Apache-Coyote/1.1
Request Headers
Accept */*
Accept-Encoding gzip, deflate
Accept-Language en-us,en;q=0.5
Connection keep-alive
Cookie DWRSESSIONID=Q62Vf$dv*S9sA8EaJm6jKW6$pyj; JSESSIONID=17E120C419F075B505447F151124BC18
Host localhost:8080
Origin null
User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1
I can get this to work fine in IE using prototype.js but there's a further complication with Firefox, I assume because the webservice is projected by an NTLM servlet filter. I've been using jQuery for non-msie browsers in order to pass through credentials using the xhrFields property, and I can see my service being invoked in the debugger from both IE & Firefox, but my response is blank when invoked from Firefox.
Is this even possible?
It appears that Firefox does not respect the Access-Control-Allow-Origin: *
header - changing the @CrossOriginResourceSharing
annotation to specify the list of host/port combinations which will access the end point fixed the issue.