1

I have tried both geoserver 2.12.5 and 2.13.2 with CORS enabled and on both i get an "Invalid CORS request" when accessing WMS from an external webapp.

steps :

  1. install geoserver, port 8095, i have tried both Linux and Windows
  2. enable CORS in web.xml
  3. restart
  4. access WMS from an angular app that runs on 9000 -> CORS Error
  5. the same call in a separate tab is getting a json response with the expected data

Accessing it through geoserver "preview layers" is working,
(also the GetFeatureInfo-call as there it is not a CORS-call)

I am using the sample layer nurc:Img_Sample

Using a different IP than 127.0.0.1 does not change anything.

http://127.0.0.1:8095/geoserver/nurc/wms?SERVICE=WMS&VERSION=1.1.1&REQUEST=GetFeatureInfo&layers=nurc:Img_Sample&time=2018-08-15/2018-09-03&info_format=application/json&BBOX=-523.3886718750001,18.97902595325528,-406.14257812500006,69.3493386397765&FEATURE_COUNT=5&HEIGHT=890&WIDTH=1334&query_layers=nurc:Img_Sample&SRS=EPSG:4326&buffer=15&X=1127&Y=415

This was working in an older version (from 2017 - so maybe 2.11 ?, or did the browsers checks change ?)

From Chrome :

Request Method: OPTIONS Status Code: 403 Forbidden Remote Address: 127.0.0.1:8095 Referrer Policy: no-referrer-when-downgrade

Response Headers :

Allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH Content-Length: 20 Server: Jetty(9.2.13.v20150730) X-Frame-Options: SAMEORIGIN

!Provisional headers are shown Access-Control-Request-Headers: authorization Access-Control-Request-Method: GET Origin: http://localhost:9000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36

From the console :

` zone.js:2224 OPTIONS http://127.0.0.1:8095/geoserver/nurc/wms?SERVICE=WMS&VERSION=1.1.1&REQUEST=GetFeatureInfo&layers=nurc:Img_Sample&time=2018-08-15/2018-09-03&info_format=application/json&BBOX=-523.3886718750001,18.97902595325528,-406.14257812500006,69.3493386397765&FEATURE_COUNT=5&HEIGHT=890&WIDTH=1334&query_layers=nurc:Img_Sample&SRS=EPSG:4326&buffer=15&X=1127&Y=415 403 (Forbidden)

zone.js:2224 OPTIONS http://127.0.0.1:8095/geoserver/nurc/wms?SERVICE=WMS&VERSION=1.1.1&REQUEST=GetFeatureInfo&layers=nurc:Img_Sample&time=2018-08-15/2018-09-03&info_format=application/json&BBOX=-523.3886718750001,18.97902595325528,-406.14257812500006,69.3493386397765&FEATURE_COUNT=5&HEIGHT=890&WIDTH=1334&query_layers=nurc:Img_Sample&SRS=EPSG:4326&buffer=15&X=1127&Y=415 403 (Forbidden)

Failed to load http://127.0.0.1:8095/geoserver/nurc/wms?SERVICE=WMS&VERSION=1.1.1&REQUEST=GetFeatureInfo&layers=nurc:Img_Sample&time=2018-08-15/2018-09-03&info_format=application/json&BBOX=-523.3886718750001,18.97902595325528,-406.14257812500006,69.3493386397765&FEATURE_COUNT=5&HEIGHT=890&WIDTH=1334&query_layers=nurc:Img_Sample&SRS=EPSG:4326&buffer=15&X=1127&Y=415: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:9000' is therefore not allowed access.

01:00:35.526 vendor.dll.js:8 ERROR HttpErrorResponse {headers: HttpHeaders, status: 0, statusText: "Unknown Error", url: null, ok: false, …}

`

Any ideas what the issue is here ?

  • Are you using jetty or tomcat? – Ian Turton Sep 3 '18 at 7:22
  • in windows this would be jetty, as the startup.bat for 2.14RC is : <br/> call "C:\Program Files\Java\jdk1.8.0_172\bin\java.exe" %MARLIN_ENABLER% -DGEOSERVER_DATA_DIR="C:\Program Files (x86)\GeoServer 2.13.2\data_dir" -Xmx512m -DSTOP.PORT=8079 -DSTOP.KEY=geoserver -Djetty.base="C:\Program Files (x86)\GeoServer 2.14-RC" -Djetty.logs="C:\Program Files (x86)\GeoServer 2.14-RC\logs" -jar "C:\Program Files (x86)\GeoServer 2.14-RC\start.jar" --module=http jetty.port=8095 – Nenad Sep 3 '18 at 11:08
  • to enable cors i followed this guide (docs.geoserver.org/latest/en/user/production/…) <br> basically edit webapps/geoserver/WEB-INF/web.xml and uncomment whatever is there for CORS, as this changes for the older versions – Nenad Sep 3 '18 at 11:17
  • Did you add the cors jar too? – Ian Turton Sep 3 '18 at 15:54
  • with 2.14RC it is already in the geoserver 2.14RC\lib directory, with 2.10 i copied one from the net with the matching revision. There are no error messages during startup, so it should be using them. – Nenad Sep 3 '18 at 19:08
1

Like Ian suspected this was not a problem with Geoserver but with another part of our program.

We are using JHipster and Angular -
on the Angular side we have a HttpInterceptor which handles Authentication etc.
We had this enabled for all requests -

  • so it cloned the request (HttpRequest.clone),
  • added the JWT Token
  • and then let the Angular HTTP-pipeline continue.

This was apparently enough to trip up the OPTIONS request.


I am still not sure why this only affected the WMS GetFeatureInfo request, we could display a map in leaflet without problems. (well leaflet probably didn't go through the angular http pipeline )

0

Add the following in web.xml file under cross-origin filter-name

<init-param>
       <param-name>allowedOrigins</param-name>
       <param-value>*</param-value>
   </init-param>
   <init-param>
       <param-name>allowedMethods</param-name>
       <param-value>GET,POST,OPTIONS,DELETE,PUT,HEAD</param-value>
   </init-param>
   <init-param>
       <param-name>allowedHeaders</param-name>
       <param-value>origin, content-type, accept, authorization</param-value>
   </init-param>
  • 1
    Welcome to GIS.SE. Some explanation what your code does could be helpful for other users, maybe you could expand your answer? – Erik Jan 2 at 11:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.