I am making request to my server using $http to my backend for login purpose but even after specifying the headers properly its pre-flighting my request and also adding headers which I never asked it too.
This is the request that I make to the server
$http({
method: 'POST',
url: 'http://localhost:8080/SignInMainServlet',
data: $httpParamSerializerJQLike({
login_source: source,
accessToken: code,
referrer_code: referral_id
}),
headers: { 'Content-Type': 'application/x-www-form-urlencoded;charset=utf-8' }
});
This is my server code to handle the request
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
// TODO Auto-generated method stub
REFERRAL_CODE_COUNT++;
String referrer_code=request.getParameter("referrer_code");
String login_source=request.getParameter("login_source");
String accessToken=request.getParameter("accessToken");
SignInMainManager m = new SignInMainManager(accessToken, referrer_code, login_source,REFERRAL_CODE_COUNT);
String result = m.signIn();
response.setContentType("text/html");
response.addHeader("Access-Control-Allow-Origin","*");
response.addHeader("Access-Control-Allow-Methods","POST");
response.addHeader("Access-Control-Allow-Headers","Content-Type");
PrintWriter out = response.getWriter();
out.println(result);
out.close();//closing the stream
}
This is the error the browser console shows
XMLHttpRequest cannot load http://localhost:8080/SignInMainServlet. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:3000' is therefore not allowed access.
This is how the request,response and general looks like on chrome for the xhr call
// Request//
OPTIONS /SignInMainServlet HTTP/1.1
Host: localhost:8080
Connection: keep-alive
Access-Control-Request-Method: POST
Origin: http://localhost:3000
User-Agent: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Mobile Safari/537.36
Access-Control-Request-Headers: authorization
Accept: */*
Referer: http://localhost:3000/
Accept-Encoding: gzip, deflate, sdch, br
Accept-Language: en-GB,en-US;q=0.8,en;q=0.6
//Response//
HTTP/1.1 200 OK
Date: Sun, 05 Feb 2017 10:44:57 GMT
Allow: POST, TRACE, OPTIONS
Content-Length: 0
Server: Jetty(8.1.14.v20131031)
//General//
Request URL:http://localhost:8080/SignInMainServlet
Request Method:OPTIONS
Status Code:200 OK
Remote Address:127.0.0.1:8080
Stuck here since a day. Really need HELP!!
I see you are using authentification. I belive your preflight request is not working cause you missed some configurations in your CORS. In that way your preflight request aborts. Setup your CORS like this:
response.addHeader("Access-Control-Allow-Origin","*");
response.addHeader("Access-Control-Allow-Methods","GET, POST, OPTIONS");
response.addHeader("Access-Control-Allow-Credentials", "true");
response.addHeader("Access-Control-Allow-Headers","Origin, Content-Type, X-Auth-Token , Authorization");
Most important is that you only configured a protected void doPost() listener. In that way the preflight OPTIONS request does not have CORS configured because its listening on doOptions(). Add a doOptions() listener and put your CORS configuration into it or define your response CORS globaly.
protected void doOptions(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
response.addHeader("Access-Control-Allow-Origin","*");
response.addHeader("Access-Control-Allow-Methods","GET, POST, OPTIONS");
response.addHeader("Access-Control-Allow-Credentials", "true");
response.addHeader("Access-Control-Allow-Headers","Origin, Content-Type, X-Auth-Token , Authorization");
PrintWriter out = response.getWriter();
out.close();//closing the stream
}