Java应用中CORS Filter配置失效求助（JDK 8 + Tomcat 8.5.29）

Hey there, let's work through why your Tomcat CorsFilter isn't generating the expected response headers. I've run into this exact issue a few times, so here are the most likely fixes to check step by step:

1. Verify Your Full CorsFilter Configuration #

You mentioned you started configuring the filter in web.xml, but incomplete or incorrect parameters are the #1 culprit here. Make sure you have all critical settings in place, including a proper filter mapping that covers your request paths:

<filter>
    <filter-name>CorsFilter</filter-name>
    <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
    <init-param>
        <param-name>cors.allowed.origins</param-name>
        <param-value>*</param-value> <!-- Replace with specific origins like https://your-app.com for production -->
    </init-param>
    <init-param>
        <param-name>cors.allowed.methods</param-name>
        <param-value>GET,POST,PUT,DELETE,OPTIONS</param-value>
    </init-param>
    <init-param>
        <param-name>cors.allowed.headers</param-name>
        <param-value>Content-Type,Authorization,X-Requested-With</param-value>
    </init-param>
    <init-param>
        <param-name>cors.exposed.headers</param-name>
        <param-value>Authorization</param-value> <!-- Expose headers your frontend needs to access -->
    </init-param>
    <init-param>
        <param-name>cors.support.credentials</param-name>
        <param-value>true</param-value> <!-- Set to true if you need to send cookies/auth tokens -->
    </init-param>
</filter>
<filter-mapping>
    <filter-name>CorsFilter</filter-name>
    <url-pattern>/*</url-pattern> <!-- Critical: This ensures the filter applies to ALL requests -->
</filter-mapping>

A common mistake is setting a restrictive <url-pattern> (like /api/*) that doesn't match your actual request paths. Double-check your request URLs against the pattern.

2. Check for Dependency Conflicts or Misconfiguration #

You're using compile group: 'org.apache.tomcat', name: 'tomcat-catalina', version: '8.5.29' in Gradle, but a few things to note here:

• If you're deploying to a standalone Tomcat server, you don't need to include this dependency in your build—Tomcat already provides the CorsFilter class. Including it can cause classloading conflicts between your war file and the server's own libraries. Remove the dependency and rely on the server's built-in class instead.
• If you're using embedded Tomcat, the dependency is necessary, but confirm it's actually being pulled in by running ./gradlew dependencies (or gradlew.bat dependencies on Windows) and checking the dependency tree for the tomcat-catalina entry.

Also, note that compile is deprecated in newer Gradle versions—consider switching to implementation if you're on Gradle 4.10+ (though compile still works for older versions).

3. Rule Out Framework Conflicts #

If your project uses a framework like Spring, it might be overriding the Tomcat CorsFilter with its own CORS handling (e.g., @CrossOrigin annotations, WebMvcConfigurer configurations). These take precedence over Tomcat's filter, so:

• Check if you have any Spring CORS configurations in place, and either remove them or adjust them to work alongside the Tomcat filter (though it's better to pick one approach to avoid conflicts).
• Ensure the Tomcat filter is mapped before any framework-specific filters in web.xml—the order of filters matters!

4. Validate Preflight OPTIONS Requests #

Browsers send an OPTIONS preflight request for "complex" CORS requests (e.g., PUT/DELETE methods, custom headers). Make sure your cors.allowed.methods includes OPTIONS (as in the example above), otherwise the filter won't handle the preflight, and your browser will block the actual request.

5. Debug with Logs #

To confirm if the CorsFilter is even being executed:

• If using standalone Tomcat, edit conf/logging.properties and add:

  org.apache.catalina.filters.CorsFilter.level = FINE
  

• Check the localhost.log file after making a request—you should see log entries showing the filter processing the request, which will help you identify if it's being skipped entirely or failing to apply headers.

Start with the configuration and filter mapping checks first—those are the most common fixes. If none of these work, let me know more details about your deployment setup (standalone vs embedded) and any other frameworks you're using!

内容的提问来源于stack exchange，提问作者SST