Origin is not allowed by Access-Control-Allow-Origin - how to enable CORS using a very simple web stack and guice

Question

I am not sure if the issue is the technologies involved, or my understanding of the technologies.

I have an html5 application written in javascript and html hosted on an apache 2.2 server.

I have a java application written in java using jetty, guice, jackson, jersey that hosts a simple REST service.

Both applications run on the same box, one on port 80 (pure html5 application hosted on apache), the other on 8080 (pure java application hosted on jetty/guice)

I believe the answer is in the headers im sending back. The CORS headers tell a browser that you allow outside applications to hit your api. I cannot seem to figure out how to configure my Jetty, Guice server to return the correct CORS headers.

I am using an imbeded Jetty server so I do not have a web.xml file to add the headers with.

It also might be something to do with how the HTML5 application server (in this case apache 2.2) is serving the application.

The apache httpd.conf file has the entry:

LoadModule headers_module modules/mod_headers.so

<IFModule mod_headers>
    Header add Access-Control-Allow-Origin "*"
    Header add Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE, HEAD
    Header add Access-Control-Allow-Headers: X-PINGOTHER
    Header add Access-Control-Max-Age: 1728000  
</IfModule>

in my guice servlet configuration I have the following:

public class RestModule extends ServletModule{

    @Override
    protected void configureServlets() {
        bind(QuestbookService.class);

        // hook Jersey into Guice Servlet
        bind(GuiceContainer.class);

        // hook Jackson into Jersey as the POJO <-> JSON mapper
        bind(JacksonJsonProvider.class).in(Scopes.SINGLETON);

        Map<String, String> guiceContainerConfig = new HashMap<String, String>();
        guiceContainerConfig.put(ResourceConfig.PROPERTY_RESOURCE_FILTER_FACTORIES,
            HttpStatusCodeMetricResourceFilterFactory.class.getCanonicalName());
        serve("/*").with(GuiceContainer.class, guiceContainerConfig);
    }
}

I think the problem is in my guice config since I don't have a place to set the response headers.

I am using an embedded jetty server and thus I figured dev mode would bypass the whole check, but I could be wrong.

Thank you for any advice.

Answer 1

Just put one line in your code file

response.addHeader("Access-Control-Allow-Origin", "*");

Replace * with your http://www.yoursite.com if you want to allow only for particular domain