I hope somebody has already figured this one out. I just installed Geoserver 2.9 on a vanilla Ubuntu 16.04 distro. The Geoserver 2.8 method of enabling CORS with the shanbe.hezoun class does no longer work with Jetty 9.2.13.

There are mentions that CORS support is already packaged with Jetty 9.2.13 in the jetty-servlets.jar.

The Jetty lib which is compiled with Geoserver contains a jetty-servlet-9.2.13.v20150730.jar in geoserver/lib but not jetty-servlets.9.2.13.v20150730.jar. Are these supposed to be the same jar with a different name?

It should be possible to enable CORS either in geoserver/etc/webdefault.xml or in geoserver/webapps/geoserver/WEB-INF/web.xml.

My understanding is that the webdefault.xml is applied first and the web.xml thereafter.

I have tried following filter in both xml. I haven't got as far as adding a filter mapping. Adding the filter alone will cause the Geoserver/Jetty service to not start proper.

  • 1
    Servlet and servlets does not seem to be the same archive.eclipse.org/jetty/9.2.13.v20150730/apidocs/…. And some links to the documents you have used would help those who try to answer.
    – user30184
    Commented Sep 9, 2016 at 12:36
  • why not use tomcat?
    – Ian Turton
    Commented Sep 9, 2016 at 12:42
  • 1
    Good question. I have Geoserver 2.9 running with Tomcat but wanted to test the binary setup just to see whether this would make my life easier. It didn't. Commented Sep 9, 2016 at 13:55
  • What was your solution?
    – Kieveli
    Commented Sep 22, 2016 at 15:01
  • 1
    Ok. I just already solved the problem for Geoserver 2.10. It's my fault to not installed the servlets jar correctly. I should download the correct servlets in here then copy into the directory "\WEB-INF\lib" and edit the "WEB-INF\web.xml" to be add the filter parameters as I followed the comment from zflaw in this thread. Jetty v9+ has already supported the CORS. Commented Feb 10, 2017 at 2:53

5 Answers 5


Edit the webapps/geoserver/WEB-INF/web.xml file. There are two references to CORS in this file:

<!-- Uncomment following filter to enable CORS -->


<!-- Uncomment following filter to enable CORS -->

You must uncomment both blocks (that is remove <!-- and --> from the filter and filter-mapping blocks.

Then when you restart Jetty you can test that everything is working by using a command like:

curl -v -H "Origin: http://example.com" http://astun-desktop:9080/geoserver/wfs\?service\=WFS\&version\=2.0.0\&request\=GetFeature\&typenames\=sf:bugsites\&filter\=%3Cfes:Filter%20xmlns:fes\=%22http://www.opengis.net/fes/2.0%22%3E%3Cfes:ResourceId%20rid\=%22bugsites.3%22/%3E%3C/fes:Filter%3E

which if all is well will give a result like:

> User-Agent: curl/7.35.0
> Host: astun-desktop:9080
> Accept: */*
> Origin: http://example.com
< HTTP/1.1 200 OK 
< Access-Control-Allow-Origin: http://example.com 
< Access-Control-Allow-Credentials: true 
< Access-Control-Expose-Headers:  
< Content-Type: text/xml; subtype=gml/3.2 
< Content-Disposition: inline; filename=geoserver-GetFeature.text 
< Transfer-Encoding: chunked
* Server Jetty(9.2.13.v20150730) is not blacklisted 
< Server: Jetty(9.2.13.v20150730) 
* Connection #0 to host astun-desktop left intact 
<?xml version="1.0" encoding="UTF-8"?><wfs:FeatureCollection xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:sf="http://www.openplans.org/spearfish" xmlns:wfs="http://www.opengis.net/wfs/2.0" xmlns:gml="http://www.opengis.net/gml/3.2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" numberMatched="1" numberReturned="1" timeStamp="2017-07-30T15:58:31.423Z" xsi:schemaLocation="http://www.opengis.net/wfs/2.0 http://astun-desktop:9080/geoserver/schemas/wfs/2.0/wfs.xsd http://www.openplans.org/spearfish http://astun-desktop:9080/geoserver/wfs?service=WFS&amp;version=2.0.0&amp;request=DescribeFeatureType&amp;typeName=sf%3Abugsites http://www.opengis.net/gml/3.2 http://astun-desktop:9080/geoserver/schemas/gml/3.2.1/gml.xsd"><wfs:member><sf:bugsites gml:id="bugsites.3"><sf:the_geom><gml:Point srsName="urn:ogc:def:crs:EPSG::26713" srsDimension="2"><gml:pos>590529 4914625</gml:pos></gml:Point></sf:the_geom><sf:cat>3</sf:cat><sf:str1>Beetle site</sf:str1></sf:bugsites></wfs:member></wfs:FeatureCollection>%

Update 24th Oct 2019

It it is no longer necessary to add the following jar to GeoServer (at least with versions 2.13.x and later) and it will cause an error. I'm leaving this note here for people fighting older versions.

  1. Add the Jetty-Utility Servlets Jar to match the version of Jetty - for current versions of GeoServer (2.15.x) it is 9.4.12.v20180830, copy this to webapps/geoserver/WEB-INF/lib inside the geoserver-2.15.0 directory (or wherever you unpacked the zip file).
  • 6
    For different versions of geoserver, I've been guessing the compatible jetty verison using find $GEOSERVER_HOME -name "jetty*" | grep -E [[:digit:]] . Commented Oct 12, 2017 at 20:42
  • 3
    How do you restart jetty?
    – user210757
    Commented Jul 31, 2018 at 17:41
  • This solution worked for me only after I added jetty-util to the lib folder as well.
    – isshp
    Commented Jul 2, 2019 at 7:50

It will work if you add the filter in "geoserver/webapp/geoserver/WEB-INF/web.xml" and if you add the jar "jetty-servlets.9.2.13.v20150730.jar" inside "geoserver/webapp/geoserver/WEB-INF/lib"

  • From where would I get the jetty-servlets.9.2.13.v20150730.jar? Is that different to the jetty-servlet-9.2.13.v20150730.jar which is packaged with Geoserver 2.9? Commented Oct 4, 2016 at 15:57
  • yes its different. Also note the destination folder is different
    – Calanus
    Commented Jan 1, 2017 at 20:42
  • I am using geoserver 2.8.2.Jetty version not getting.Can any tell me how to find jetty version.I am seeing only jetty-6.8.1 in C:/Program Files (x86)/GeoServer 2.8.2/lib Commented Feb 20, 2018 at 6:41

with Jetty9, UbuntuServer 16.04, i also had to modify /etc/jetty9/start.ini, so as not to get the following error :

2018-03-31 15:10:01.769:WARN:oejuc.AbstractLifeCycle:main: FAILED cross-origin: javax.servlet.UnavailableException: org.eclipse.jetty.servlets.CrossOriginFilter javax.servlet.UnavailableException: org.eclipse.jetty.servlets.CrossOriginFilter

the solution is here : you should enable the servlets module in your ${jetty.base}/start.ini

consequently, i replaced :


by :


Accepted answer by Ian Turton is absolutely best here. Since I'm using Docker manual editing is not the case. Also I'm not a SED guru, but thanks to structure of web.xml (target strings are unique in document scope), I come up with little snippet:

sed -i 's_<!-- <filter>_<filter>_' web.xml
sed -i 's_</filter> -->_</filter>_' web.xml
sed -i 's_<!-- <filter-mapping>_<filter-mapping>_' web.xml
sed -i 's_</filter-mapping> -->_</filter-mapping>_' web.xml

Or in Dockerfile:

# enable CORS
RUN wget -q http://central.maven.org/maven2/org/eclipse/jetty/jetty-servlets/9.2.13.v20150730/jetty-servlets-9.2.13.v20150730.jar -P ${GEOSERVER_INSTALL_DIR}/WEB-INF/lib \
 && sed -i 's_<!-- <filter>_<filter>_' ${GEOSERVER_INSTALL_DIR}/WEB-INF/web.xml \
 && sed -i 's_</filter> -->_</filter>_' ${GEOSERVER_INSTALL_DIR}/WEB-INF/web.xml \
 && sed -i 's_<!-- <filter-mapping>_<filter-mapping>_' ${GEOSERVER_INSTALL_DIR}/WEB-INF/web.xml \
 && sed -i 's_</filter-mapping> -->_</filter-mapping>_' ${GEOSERVER_INSTALL_DIR}/WEB-INF/web.xml

For anyone is wondering which version of jetty you have for your particular geoserver application.

For OSX I simply started geoserver and looked in the log it should show something like:

2019-05-10 07:25:13.444:INFO:oejs.Server:startup executor: jetty-9.2.13.v20150730

I'm sure it is similar in the tomcat logs when running from a linux server if needed.

Also, it should be visible in the response headers ie:

Connection: close
Server: Jetty(9.2.13.v20150730)
X-Frame-Options: SAMEORIGIN

Ie, as the accepted answer mentions try using curl command it will present the server version too:

curl -v -H "Origin: http://example.com" http://astun-desktop:9080/geoserver/wfs\?service\=WFS\&version\=2.0.0\&request\=GetFeature\&typenames\=sf:bugsites\&filter\=%3Cfes:Filter%20xmlns:fes\=%22http://www.opengis.net/fes/2.0%22%3E%3Cfes:ResourceId%20rid\=%22bugsites.3%22/%3E%3C/fes:Filter%3E

Not the answer you're looking for? Browse other questions tagged or ask your own question.