java - Origin is not allowed by Access-Control-Allow-Origin - how to enable CORS using a very simple web stack and guice -

i not sure if issue technologies involved, or understanding of technologies.

i have html5 application written in javascript , html hosted on apache 2.2 server.

i have java application written in java using jetty, guice, jackson, jersey hosts simple rest service.

both applications run on same box, 1 on port 80 (pure html5 application hosted on apache), other on 8080 (pure java application hosted on jetty/guice)

i believe answer in headers im sending back. cors headers tell browser allow outside applications hit api. cannot seem figure out how configure jetty, guice server return correct cors headers.

i using imbeded jetty server not have web.xml file add headers with.

it might how html5 application server (in case apache 2.2) serving application.

the apache httpd.conf file has entry:

loadmodule headers_module modules/mod_headers.so  <ifmodule mod_headers>     header add access-control-allow-origin "*"     header add access-control-allow-methods: post, get, options, put, delete, head     header add access-control-allow-headers: x-pingother     header add access-control-max-age: 1728000   </ifmodule> 

in guice servlet configuration have following:

public class restmodule extends servletmodule{      @override     protected void configureservlets() {         bind(questbookservice.class);          // hook jersey guice servlet         bind(guicecontainer.class);          // hook jackson jersey pojo <-> json mapper         bind(jacksonjsonprovider.class).in(scopes.singleton);          map<string, string> guicecontainerconfig = new hashmap<string, string>();         guicecontainerconfig.put(resourceconfig.property_resource_filter_factories,             httpstatuscodemetricresourcefilterfactory.class.getcanonicalname());         serve("/*").with(guicecontainer.class, guicecontainerconfig);     } } 

i think problem in guice config since don't have place set response headers.

i using embedded jetty server , figured dev mode bypass whole check, wrong.

thank advice.

do specific requirements of application. server needs seporate completly seporate client. client should able connect communication server via method can.

since first implementation of application going rest driven, need able accept rest anywhere.

in addition, want completly xml-less config, use guice imbedded jetty server. since not have web.xml file, not figure out how set headers allow cors.

after alot of trial , error, , reading guice documentation, found how add cors headers response leaving server.

the guice servletmodule class allows add filters servlet context. allows me have requests pass through given servlet.

since trying build rest application responds cors requests, needed filter added cors headers response of request. right now, responding requests, respond if service layer responds 200 - 300 response code.

so enable cors in embedded server using guice built filter looks this:

@singleton public class corsfilter implements filter{      @override     public void dofilter(servletrequest request, servletresponse response,     filterchain filterchain) throws ioexception, servletexception {          if(response instanceof httpservletresponse){         httpservletresponse alteredresponse = ((httpservletresponse)response);         addcorsheader(alteredresponse);     }      filterchain.dofilter(request, response);     }      private void addcorsheader(httpservletresponse response){         //todo: externalize allow-origin         response.addheader("access-control-allow-origin", "*");         response.addheader("access-control-allow-methods", "post, get, options, put, delete, head");         response.addheader("access-control-allow-headers", "x-pingother, origin, x-requested-with, content-type, accept");         response.addheader("access-control-max-age", "1728000");     }      @override     public void destroy() {}      @override     public void init(filterconfig filterconfig)throws servletexception{} } 

guice provides abstract class allows configure guice servlet.

the configuration module looks this:

public class restmodule extends servletmodule{      @override     protected void configureservlets() {         bind(myserviceclass.class);          // hook jersey guice servlet         bind(guicecontainer.class);          // hook jackson jersey pojo <-> json mapper         bind(jacksonjsonprovider.class).in(scopes.singleton);          map<string, string> guicecontainerconfig = new hashmap<string, string>();          serve("/*").with(guicecontainer.class, guicecontainerconfig);          filter("/*").through(corsfilter.class);     } } 

now guice add cors headers every response. allowing pure html 5 application talk it, no matter being served.