Why does CORS enabling in Geoserver does not work?

Question

I' am trying to rewrite my programmed WebGis (OpenLayers 6.14.1) to node.js to serve it. I am very new to this issue. Actually, the geodata is stored in a POSTGIS-database, served via Geoserver in local Tomcat.

In the Tomcat 9.0/webapps/geoserver/WEB-INF/web.xml file, I have uncommented the two parts for enabling CORS.

    <filter>
      <filter-name>cross-origin</filter-name>
      <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
      <init-param>
        <param-name>cors.allowed.origins</param-name>
        <param-value>*</param-value>
      </init-param>
      <init-param>
        <param-name>cors.allowed.methods</param-name>
        <param-value>GET,POST,PUT,DELETE,HEAD,OPTIONS</param-value>
      </init-param>
      <init-param>
        <param-name>cors.allowed.headers</param-name>
        <param-value>*</param-value>
      </init-param>
    </filter>

and

    <filter-mapping>
        <filter-name>cross-origin</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

In MS Edge and Chrome, I get directly the CORS errors and my data isn't shown:

Access to image at 'http://localhost:8082/webgis/Daten/Symbole/GUI/Legende.svg' from origin 'http://website.de:1234' has been blocked by CORS policy: The request client is not a secure context and the resource is in more-private address space `local`

Access to fetch at 'http://localhost:8082/geoserver/crowdnew/ows?service=WFS&version=1.0.0&request=GetFeature&typeName=crowdnew%3Acrowdmapping&outputFormat=application%2Fjson' from origin 'http://website.de:1234' has been blocked by CORS policy: The request client is not a secure context and the resource is in more-private address space `local`.

In Firefox, data is shown (with and without active CORS-disabling extension). But if I send a POST request to the server (adding new data to the dataset inside the application), I get this error:

Code for request:

var req1 = new XMLHttpRequest();
    
    req1.open("POST", 'http:/localhost:8082/geoserver/wfs', false);
    
    req1.setRequestHeader('User-Agent', 'XMLHTTP/1.0');
    req1.setRequestHeader('Content-type', 'text/xml');
    req1.setRequestHeader('Access-Control-Allow-Origin', '*');
    
    
    req1.onreadystatechange = function() {
        if (req1.readyState != 4) return;
        if (req1.status != 200 && req1.status != 304) {
            alert('HTTP error ' + req1.status);
            return;
        }
    }

    if (req1.readyState == 4) return;
        req1.send(postData1);

XHR POST http://website.de:1234/localhost:8082/geoserver/wfs
[HTTP/1.1 405 Method Not Allowed 65ms]

When I click on this information I receive an answer with:

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Content-Type
Access-Control-Allow-Methods: GET, HEAD, PUT, PATCH, POST, DELETE
Access-Control-Allow-Origin:*
Allow: GET, HEAD

I've read CORS - Tomcat - Geoserver before, but when I add the mentioned code to the /conf/web.xml, the data isn't even shown in Firefox.

Does anybody know what to do?

I try to set up a new geoserver instance (and also a POSTGIS Database) on the same server as my node.js server. Maybe it will resolve the problem about the CORS 'local'. The data is saved on localhost only for test purpose. — Chris_98, Sep 13 '22 at 14:01

score 0 · Answer 1 · answered Sep 13 '22 at 11:58

0

1st the Not Allowed error is probably because you haven't authenticated, by default GeoServer requires authentication before users can alter the underlying data.

The CORS issue is to do with private networks and the solution given in this answer is to add a Access-Control-Allow-Private-Network header or server your client pages with HTTPS (or turn off security)

answered Sep 13 '22 at 11:58

Ian Turton

10,018
1
28
47

Thanks for your answer. But how can I authenticate in geoserver? And where can I add the Access-Control-Allow-Private-Network header? Do I have to add it to the geoserver web.xml? – Chris_98 Sep 13 '22 at 12:21
You need to send it as a header on all of your requests. As for authentication you send a basic authentication header with your user name and password as with any other website – Ian Turton Sep 13 '22 at 12:40
How can I set the headers on the requests? For example, when I have declared a `url` variable with the link as a string and insert this to a `new VectorSource` object in Openlayers. I don't understand where I have to insert the header. – Chris_98 Sep 13 '22 at 13:04
I've no idea - but this isn't a geoserver problem – Ian Turton Sep 13 '22 at 13:50

Why does CORS enabling in Geoserver does not work?

1 Answers1