I have tried both geoserver 2.12.5 and 2.13.2 with CORS enabled and on both i get an "Invalid CORS request" when accessing WMS from an external webapp.

steps :

  1. install geoserver, port 8095, i have tried both Linux and Windows
  2. enable CORS in web.xml
  3. restart
  4. access WMS from an angular app that runs on 9000 -> CORS Error
  5. the same call in a separate tab is getting a json response with the expected data

Accessing it through geoserver "preview layers" is working,
(also the GetFeatureInfo-call as there it is not a CORS-call)

I am using the sample layer nurc:Img_Sample

Using a different IP than does not change anything.,18.97902595325528,-406.14257812500006,69.3493386397765&FEATURE_COUNT=5&HEIGHT=890&WIDTH=1334&query_layers=nurc:Img_Sample&SRS=EPSG:4326&buffer=15&X=1127&Y=415

This was working in an older version (from 2017 - so maybe 2.11 ?, or did the browsers checks change ?)

From Chrome :

Request Method: OPTIONS Status Code: 403 Forbidden Remote Address: Referrer Policy: no-referrer-when-downgrade

Response Headers :

Allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH Content-Length: 20 Server: Jetty(9.2.13.v20150730) X-Frame-Options: SAMEORIGIN

!Provisional headers are shown Access-Control-Request-Headers: authorization Access-Control-Request-Method: GET Origin: http://localhost:9000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36

From the console :

` zone.js:2224 OPTIONS,18.97902595325528,-406.14257812500006,69.3493386397765&FEATURE_COUNT=5&HEIGHT=890&WIDTH=1334&query_layers=nurc:Img_Sample&SRS=EPSG:4326&buffer=15&X=1127&Y=415 403 (Forbidden)

zone.js:2224 OPTIONS,18.97902595325528,-406.14257812500006,69.3493386397765&FEATURE_COUNT=5&HEIGHT=890&WIDTH=1334&query_layers=nurc:Img_Sample&SRS=EPSG:4326&buffer=15&X=1127&Y=415 403 (Forbidden)

Failed to load,18.97902595325528,-406.14257812500006,69.3493386397765&FEATURE_COUNT=5&HEIGHT=890&WIDTH=1334&query_layers=nurc:Img_Sample&SRS=EPSG:4326&buffer=15&X=1127&Y=415: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:9000' is therefore not allowed access.

01:00:35.526 vendor.dll.js:8 ERROR HttpErrorResponse {headers: HttpHeaders, status: 0, statusText: "Unknown Error", url: null, ok: false, …}


Any ideas what the issue is here ?

  • Are you using jetty or tomcat?
    – Ian Turton
    Commented Sep 3, 2018 at 7:22
  • in windows this would be jetty, as the startup.bat for 2.14RC is : <br/> call "C:\Program Files\Java\jdk1.8.0_172\bin\java.exe" %MARLIN_ENABLER% -DGEOSERVER_DATA_DIR="C:\Program Files (x86)\GeoServer 2.13.2\data_dir" -Xmx512m -DSTOP.PORT=8079 -DSTOP.KEY=geoserver -Djetty.base="C:\Program Files (x86)\GeoServer 2.14-RC" -Djetty.logs="C:\Program Files (x86)\GeoServer 2.14-RC\logs" -jar "C:\Program Files (x86)\GeoServer 2.14-RC\start.jar" --module=http jetty.port=8095
    – Nenad
    Commented Sep 3, 2018 at 11:08
  • to enable cors i followed this guide (docs.geoserver.org/latest/en/user/production/…) <br> basically edit webapps/geoserver/WEB-INF/web.xml and uncomment whatever is there for CORS, as this changes for the older versions
    – Nenad
    Commented Sep 3, 2018 at 11:17
  • Did you add the cors jar too?
    – Ian Turton
    Commented Sep 3, 2018 at 15:54
  • 1
    i started every time from a fresh geoserver installation, i posted all my configuration changes, so this should be trivial for someone else to check, right ? So probably i should post it to the bugtracker. What do you think ? Any other way to find out what is happening here ? if really needed i can make a trivial angular app with a big button which just does the CORS call, so they/you have a simple test case.
    – Nenad
    Commented Sep 8, 2018 at 21:36

3 Answers 3


Add the following in web.xml file under cross-origin filter-name

       <param-value>origin, content-type, accept, authorization</param-value>
  • 1
    Welcome to GIS.SE. Some explanation what your code does could be helpful for other users, maybe you could expand your answer?
    – Erik
    Commented Jan 2, 2019 at 11:19

Like Ian suspected this was not a problem with Geoserver but with another part of our program.

We are using JHipster and Angular -
on the Angular side we have a HttpInterceptor which handles Authentication etc.
We had this enabled for all requests -

  • so it cloned the request (HttpRequest.clone),
  • added the JWT Token
  • and then let the Angular HTTP-pipeline continue.

This was apparently enough to trip up the OPTIONS request.

I am still not sure why this only affected the WMS GetFeatureInfo request, we could display a map in leaflet without problems. (well leaflet probably didn't go through the angular http pipeline )


I had the problem when I wanted to view a WMS layer using Cesium Ion or Mapbox library in a React app. The layer required authentication (i.e, basic authentication), so I had to pass Authorization header with my Cesium.Resource. So, preflight requests before the actual GET request was sent and they were rejected due to CORS policy.

It is said in CORS Specifications that preflight requests must be rejected if any of submitted header does not match the allowed CORS headers. The default configuration of the CorsFilter cors.allowed.headers (including mine) does not include the Authorization header that is sent with the request (Link). However, I made an update to the cors.allowed.headers filter setting to include acceptance of the authorization header, resulting in a successful preflight request:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.