Feature request: Add CORS support to jease

[Slava Pankov]

https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS

It's quite important to be able to use jease in cross domain scenarios.

[Slava Pankov]

UPDATE:

It's very strange, but looks like jease is doing something wrong with response.
jease must not be responsible for CORS directly, but should not mess with application server.
I have CORS filter configured on my Tomcat, and it works for other webapps, but not for jease.

And if I put explicitly response.addHeader("Access-Control-Allow-Origin", "*") to File.jsp for example, it's not working as well, no Access-Control-Allow-Origin goes into response.

[Maik Jablonski]

Hi,

I've just added a custom servlet filter (see below) which worked fine.
I've tried to enable the CORS filter provided by Tomcat, but without
success. No idea what's going wrong, but maybe it is related to this
issue:

http://stackoverflow.com/questions/24386712/tomcat-cors-filter

Maybe you can try to debug into this issue a little bit further.

Cheers, Maik

import java.io.IOException;

import javax.servlet.DispatcherType;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletResponse;

@WebFilter(urlPatterns = { "/*" }, dispatcherTypes = { DispatcherType.REQUEST,
DispatcherType.FORWARD, DispatcherType.INCLUDE, DispatcherType.ERROR })
public class SimpleCORSFilter implements Filter {

public void init(FilterConfig config) throws ServletException {
}

public void doFilter(ServletRequest req, ServletResponse res,
FilterChain chain) throws IOException, ServletException {
HttpServletResponse response = (HttpServletResponse) res;
response.setHeader("Access-Control-Allow-Origin", "*");
response.setHeader("Access-Control-Allow-Methods",
"POST, GET, OPTIONS, DELETE");
response.setHeader("Access-Control-Max-Age", "3600");
response.setHeader("Access-Control-Allow-Headers", "x-requested-with");
chain.doFilter(req, res);
}

public void destroy() {

> --
> You received this message because you are subscribed to the Google Groups
> "Jease - The Java CMS with Ease" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to jease+un...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[Slava Pankov]

No, you missed that I was saying, that Tomcat CORS filter is working for other web apps and hosted files, but not for jease.
I will try to dig into this tomorrow, but it's jease problem with high probability.

[Slava Pankov]

I've spent few hours today trying to make Tomcat's CORS filter to work with jease. No luck, I'm completely out of ideas.
But I need working CORS, so I have a questions about your filter.
How can I use it? I don't see it included into nightly build. Also even if it's included, there should be a way how to configure it, at least through properties file.
Please include CORS filter into jease and make it configurable.

Also regarding JSONP support. Adding jsonp into mime types is nice, but not enough for real use cases.
It has dynamic nature, because callback name is coming in the particular request.
So I think modified File.jsp should be included into jease, see attachment. It will allow to get any file with text nature from jease by using jsonp.

[Slava Pankov]

Minor fix, utf8 was not properly supported by java.io.FileReader, so I've replaced it with java.io.InputStreamReader:

//fr = new java.io.FileReader(file.getFile());
fr = new java.io.InputStreamReader(new java.io.FileInputStream(file.getFile()), utf8);