Credential is not supported if the CORS header ‘Access-Control-Allow-Origin’ is ‘*’
up vote
0
down vote
favorite
My application do some REST request in a java web application. the requests are CORS requests so the browser do every time an OPTION preflight before the real one.
Each request are similar to
Host: localhost:8080 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64;
x64; rv:63.0) Gecko/20100101 Firefox/63.0 Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding:
gzip, deflate Access-Control-Request-Method: GET
Access-Control-Request-Headers: iv-groups,iv-user,x-xsrf-token Origin:
http://localhost:4200 Connection: keep-alive Cache-Control: max-age=0
The java application response is:
HTTP/1.1 200 Set-Cookie: JSESSIONID=70A5ED7E8D32DCEE55991D3945994AB0;
Path=/blablab; HttpOnly Set-Cookie:
XSRF-TOKEN=35ad4230-b664-400c-84c0-7d06877bf05d; Path=/ Vary: Origin
Vary: Access-Control-Request-Method Vary:
Access-Control-Request-Headers Access-Control-Allow-Origin:
http://localhost:4200 Access-Control-Allow-Methods:
GET,POST,PUT,DELETE,HEAD,OPTIONS Access-Control-Allow-Headers:
iv-groups, iv-user, x-xsrf-token Access-Control-Allow-Credentials:
true Access-Control-Max-Age: 1800 Allow: GET, HEAD, POST, PUT, DELETE,
TRACE, OPTIONS, PATCH X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store,
max-age=0, must-revalidate Pragma: no-cache Expires: 0
X-Frame-Options: DENY Content-Length: 0 Date: Thu, 22 Nov 2018
08:31:18 GMT
For firefox this response is an CORS violation on the console it writes Credential is not supported if the CORS header Access-Control-Allow-Origin is *.
For google chrome the request is ok and the content is showed.
angular
google-chrome spring-boot firefox xmlhttprequest edited Nov 22 at 9:18
MohammadReza Alagheband
1,186714
asked Nov 22 at 8:58
Vito Chiarello
1
add a comment |
up vote
0
down vote
favorite
My application do some REST request in a java web application. the requests are CORS requests so the browser do every time an OPTION preflight before the real one.
Each request are similar to
Host: localhost:8080 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64;
x64; rv:63.0) Gecko/20100101 Firefox/63.0 Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding:
gzip, deflate Access-Control-Request-Method: GET
Access-Control-Request-Headers: iv-groups,iv-user,x-xsrf-token Origin:
http://localhost:4200 Connection: keep-alive Cache-Control: max-age=0
The java application response is:
HTTP/1.1 200 Set-Cookie: JSESSIONID=70A5ED7E8D32DCEE55991D3945994AB0;
Path=/blablab; HttpOnly Set-Cookie:
XSRF-TOKEN=35ad4230-b664-400c-84c0-7d06877bf05d; Path=/ Vary: Origin
Vary: Access-Control-Request-Method Vary:
Access-Control-Request-Headers Access-Control-Allow-Origin:
http://localhost:4200 Access-Control-Allow-Methods:
GET,POST,PUT,DELETE,HEAD,OPTIONS Access-Control-Allow-Headers:
iv-groups, iv-user, x-xsrf-token Access-Control-Allow-Credentials:
true Access-Control-Max-Age: 1800 Allow: GET, HEAD, POST, PUT, DELETE,
TRACE, OPTIONS, PATCH X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store,
max-age=0, must-revalidate Pragma: no-cache Expires: 0
X-Frame-Options: DENY Content-Length: 0 Date: Thu, 22 Nov 2018
08:31:18 GMT
For firefox this response is an CORS violation on the console it writes Credential is not supported if the CORS header Access-Control-Allow-Origin is *.
For google chrome the request is ok and the content is showed.
angular
google-chrome spring-boot firefox xmlhttprequest edited Nov 22 at 9:18
MohammadReza Alagheband
1,186714
asked Nov 22 at 8:58
Vito Chiarello
1
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
My application do some REST request in a java web application. the requests are CORS requests so the browser do every time an OPTION preflight before the real one.
Each request are similar to
Host: localhost:8080 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64;
x64; rv:63.0) Gecko/20100101 Firefox/63.0 Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding:
gzip, deflate Access-Control-Request-Method: GET
Access-Control-Request-Headers: iv-groups,iv-user,x-xsrf-token Origin:
http://localhost:4200 Connection: keep-alive Cache-Control: max-age=0
The java application response is:
HTTP/1.1 200 Set-Cookie: JSESSIONID=70A5ED7E8D32DCEE55991D3945994AB0;
Path=/blablab; HttpOnly Set-Cookie:
XSRF-TOKEN=35ad4230-b664-400c-84c0-7d06877bf05d; Path=/ Vary: Origin
Vary: Access-Control-Request-Method Vary:
Access-Control-Request-Headers Access-Control-Allow-Origin:
http://localhost:4200 Access-Control-Allow-Methods:
GET,POST,PUT,DELETE,HEAD,OPTIONS Access-Control-Allow-Headers:
iv-groups, iv-user, x-xsrf-token Access-Control-Allow-Credentials:
true Access-Control-Max-Age: 1800 Allow: GET, HEAD, POST, PUT, DELETE,
TRACE, OPTIONS, PATCH X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store,
max-age=0, must-revalidate Pragma: no-cache Expires: 0
X-Frame-Options: DENY Content-Length: 0 Date: Thu, 22 Nov 2018
08:31:18 GMT
For firefox this response is an CORS violation on the console it writes Credential is not supported if the CORS header Access-Control-Allow-Origin is *.
For google chrome the request is ok and the content is showed.
angular
google-chrome spring-boot firefox xmlhttprequest edited Nov 22 at 9:18
MohammadReza Alagheband
1,186714
asked Nov 22 at 8:58
Vito Chiarello
1
My application do some REST request in a java web application. the requests are CORS requests so the browser do every time an OPTION preflight before the real one.
Each request are similar to
Host: localhost:8080 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64;
x64; rv:63.0) Gecko/20100101 Firefox/63.0 Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding:
gzip, deflate Access-Control-Request-Method: GET
Access-Control-Request-Headers: iv-groups,iv-user,x-xsrf-token Origin:
http://localhost:4200 Connection: keep-alive Cache-Control: max-age=0
The java application response is:
HTTP/1.1 200 Set-Cookie: JSESSIONID=70A5ED7E8D32DCEE55991D3945994AB0;
Path=/blablab; HttpOnly Set-Cookie:
XSRF-TOKEN=35ad4230-b664-400c-84c0-7d06877bf05d; Path=/ Vary: Origin
Vary: Access-Control-Request-Method Vary:
Access-Control-Request-Headers Access-Control-Allow-Origin:
http://localhost:4200 Access-Control-Allow-Methods:
GET,POST,PUT,DELETE,HEAD,OPTIONS Access-Control-Allow-Headers:
iv-groups, iv-user, x-xsrf-token Access-Control-Allow-Credentials:
true Access-Control-Max-Age: 1800 Allow: GET, HEAD, POST, PUT, DELETE,
TRACE, OPTIONS, PATCH X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store,
max-age=0, must-revalidate Pragma: no-cache Expires: 0
X-Frame-Options: DENY Content-Length: 0 Date: Thu, 22 Nov 2018
08:31:18 GMT
For firefox this response is an CORS violation on the console it writes Credential is not supported if the CORS header Access-Control-Allow-Origin is *.
For google chrome the request is ok and the content is showed.
angular
google-chrome spring-boot firefox xmlhttprequest angular
google-chrome spring-boot firefox xmlhttprequest edited Nov 22 at 9:18
MohammadReza Alagheband
1,186714
asked Nov 22 at 8:58
Vito Chiarello
1
edited Nov 22 at 9:18
MohammadReza Alagheband
1,186714
asked Nov 22 at 8:58
Vito Chiarello
1
edited Nov 22 at 9:18
MohammadReza Alagheband
1,186714
edited Nov 22 at 9:18
MohammadReza Alagheband
1,186714
edited Nov 22 at 9:18
MohammadReza Alagheband
1,186714
1,186714
asked Nov 22 at 8:58
Vito Chiarello
1
asked Nov 22 at 8:58
Vito Chiarello
1
asked Nov 22 at 8:58
Vito Chiarello
1
1
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
up vote
0
down vote
That happens if you are using withCredentials in your client side request. In that case you can modify the server side to check allowed referers and send the correct url in the Access-Control-Allow-Origin header. If you do not use credentials * is accepted.
Some more information can be found here: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials
answered Nov 22 at 11:02
Ludwig
55636
But how you can see the server response contains in the header Access-Control-Allow-Origin: localhost:4200 and not Access-Control-Allow-Origin: * In google chrome always is ok but in firefox seems the problem is always there.
– Vito Chiarello
Nov 23 at 10:50
add a comment |
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
That happens if you are using withCredentials in your client side request. In that case you can modify the server side to check allowed referers and send the correct url in the Access-Control-Allow-Origin header. If you do not use credentials * is accepted.
Some more information can be found here: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials
answered Nov 22 at 11:02
Ludwig
55636
But how you can see the server response contains in the header Access-Control-Allow-Origin: localhost:4200 and not Access-Control-Allow-Origin: * In google chrome always is ok but in firefox seems the problem is always there.
– Vito Chiarello
Nov 23 at 10:50
add a comment |
up vote
0
down vote
That happens if you are using withCredentials in your client side request. In that case you can modify the server side to check allowed referers and send the correct url in the Access-Control-Allow-Origin header. If you do not use credentials * is accepted.
Some more information can be found here: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials
answered Nov 22 at 11:02
Ludwig
55636
But how you can see the server response contains in the header Access-Control-Allow-Origin: localhost:4200 and not Access-Control-Allow-Origin: * In google chrome always is ok but in firefox seems the problem is always there.
– Vito Chiarello
Nov 23 at 10:50
add a comment |
up vote
0
down vote
up vote
0
down vote
That happens if you are using withCredentials in your client side request. In that case you can modify the server side to check allowed referers and send the correct url in the Access-Control-Allow-Origin header. If you do not use credentials * is accepted.
Some more information can be found here: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials
answered Nov 22 at 11:02
Ludwig
55636
That happens if you are using withCredentials in your client side request. In that case you can modify the server side to check allowed referers and send the correct url in the Access-Control-Allow-Origin header. If you do not use credentials * is accepted.
Some more information can be found here: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials
answered Nov 22 at 11:02
Ludwig
55636
answered Nov 22 at 11:02
Ludwig
55636
answered Nov 22 at 11:02
Ludwig
55636
answered Nov 22 at 11:02
Ludwig
55636
55636
But how you can see the server response contains in the header Access-Control-Allow-Origin: localhost:4200 and not Access-Control-Allow-Origin: * In google chrome always is ok but in firefox seems the problem is always there.
– Vito Chiarello
Nov 23 at 10:50
add a comment |
But how you can see the server response contains in the header Access-Control-Allow-Origin: localhost:4200 and not Access-Control-Allow-Origin: * In google chrome always is ok but in firefox seems the problem is always there.
– Vito Chiarello
Nov 23 at 10:50
But how you can see the server response contains in the header Access-Control-Allow-Origin: localhost:4200 and not Access-Control-Allow-Origin: * In google chrome always is ok but in firefox seems the problem is always there.
– Vito Chiarello
Nov 23 at 10:50
But how you can see the server response contains in the header Access-Control-Allow-Origin: localhost:4200 and not Access-Control-Allow-Origin: * In google chrome always is ok but in firefox seems the problem is always there.
– Vito Chiarello
Nov 23 at 10:50
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53427156%2fcredential-is-not-supported-if-the-cors-header-access-control-allow-origin-is%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
