This article focuses on how to enable CORS in Ephesoft Transact and resolve Access Control Allow Origin Exception with customer web application.
What is CORS?
CORS is a security feature that uses HTTP Headers that can be sent from the web server and interpreted by the browser to allow the browser to decide if it should proceed with a request or not. Part of the CORS mechanism involves the browser making a ‘preflight’ OPTIONS request to the web server so it can decide if it should send the actual request or not. Something that’s important to note here is that CORS checks are only made for requests that are not categorized as ‘simple requests’ and one of the triggers for requests to our APIs is the inclusion of an ‘Authorization’ header.
So in the current Transact configuration we have two issues:
- OPTIONS requests are not supported by the current web.xml configuration: OPTIONS requests need to be supported WITHOUT the requirement for the request to be sent with authentication (since CORS preflight requests do not include authentication). Configuration needs to be added to Ephesoft\Application\WEB-INF\
web.xml enables this support
- CORS response headers are not configured to be returned to a client that requests them. We need to add an additional filter configuration which needs to be added to Ephesoft\JavaAppServer\conf\
Add the following to Ephesoft\JavaAppServer\conf\
Add the following to: Ephesoft\Application\WEB-INF\