Hello,
Here is my web.xml file:
And I try to set a GET request from my application with the following headers
'Content-Type': 'application/json',
'Authorization': "Basic ZGVtbzpkZW1v",
'Cache-Control': "no-cache"
to http://localhost:8080/engine-rest/user
I traced my request using Postman. Here are the headers in the request:
[{“key”:“Access-Control-Request-Method”,“value”:“GET”,“description”:“”},{“key”:“Origin”,“value”:“http://evil.com/“,“description”:””},
{“key”:“X-DevTools-Emulate-Network-Conditions-Client
Id”,“value”:“6B279966ED84E2BE5D06B4F083711A81”,“description”:“”},
,{“key”:“Access-Control-Request-Headers”,“value”:“authorization,cache-control,content-type”,“description”:“”},{“key”:“Accept”,“value”:“/”,“description”:“”},
{“key”:“Accept-Encoding”,“value”:“gzip, deflate, br”,“description”:“”}
,{“key”:“Accept-Language”,“value”:“en-US,en;q=0.9”,“description”:“”},
{“key”:“Authorization”,“value”:“Basic ZGVtbzpkZW1v”,“description”:“”}]
If I add an Authorisation header I can send the request. But normally the Options shouldn’t use authorisation, right ? Otherwise I get the error 401 Unauthorize.
How can I make the CROS work, without using a proxy ?