Implementing Cross-Origin Resource Sharing (CORS) in play-framework version 2.5.x: A Step-by-Step Guide

Question

Implementing Cross-Origin Resource Sharing (CORS) in play-framework version 2.5.x: A Step-by-Step Guide

My current challenge involves retrieving JSON data by sending a request to a Restful URL from localhost within an AngularJS-1 application.

The error that I encounter is as follows:

http://localhost:9000/mlm/user/all Failed to load resource: 
the server responded with a status of 404 (Not Found)

index.html:1 XMLHttpRequest cannot load http://localhost:9000/mlm/user/all. 

Response to preflight request doesn't pass access control check:
No 'Access-Control-Allow-Origin' header is present on the requested resource.

Origin 'http://localhost:63342' is therefore not allowed access. 

The response had HTTP status code 404.

In this scenario, I am utilizing play-framework 2.5.4 (java).

Update 1: I have included CORS settings in app.conf

    play.filters {
    cors {
    # Filter paths by a whitelist of path prefixes
    pathPrefixes = ["/"]

    # The allowed origins. If null, all origins are allowed.
    allowedOrigins = null

    # The allowed HTTP methods. If null, all methods are allowed
    allowedHttpMethods = ["GET", "POST"]

    allowedHttpHeaders = ["Accept"]
    preflightMaxAge = 3 days
  }
}

javascript angularjs rest playframework playframework-2.3

Answer 1

Answer №1

Finally, I found a solution that worked for me.

After reading the official documentation, I discovered that the Filter.java code mentioned there did not work as expected:

import play.mvc.EssentialFilter;
import play.filters.cors.CORSFilter;
import play.http.DefaultHttpFilters;

import javax.inject.Inject;

public class Filters extends DefaultHttpFilters {
    @Inject public Filters(CORSFilter corsFilter) {
        super(corsFilter);
    }
}

Instead, I found success with this version of the Filter.java code:

import play.mvc.EssentialFilter;
import play.filters.cors.CORSFilter;
import play.http.HttpFilters;
import javax.inject.Inject;

public class Filters implements HttpFilters {

    @Inject
    CORSFilter corsFilter;

    public EssentialFilter[] filters() {
        return new EssentialFilter[] { corsFilter.asJava() };
    }
}

I want to express my gratitude to this helpful answer on a related question in Stack Overflow.

However, the million-dollar question remains: why does the official Filter.java code provided in the 2.5.x documentation fail to work properly?

Answer 2

Finally, I found a solution that worked for me.

After reading the official documentation, I discovered that the Filter.java code mentioned there did not work as expected:

import play.mvc.EssentialFilter;
import play.filters.cors.CORSFilter;
import play.http.DefaultHttpFilters;

import javax.inject.Inject;

public class Filters extends DefaultHttpFilters {
    @Inject public Filters(CORSFilter corsFilter) {
        super(corsFilter);
    }
}

Instead, I found success with this version of the Filter.java code:

import play.mvc.EssentialFilter;
import play.filters.cors.CORSFilter;
import play.http.HttpFilters;
import javax.inject.Inject;

public class Filters implements HttpFilters {

    @Inject
    CORSFilter corsFilter;

    public EssentialFilter[] filters() {
        return new EssentialFilter[] { corsFilter.asJava() };
    }
}

I want to express my gratitude to this helpful answer on a related question in Stack Overflow.

However, the million-dollar question remains: why does the official Filter.java code provided in the 2.5.x documentation fail to work properly?

Answer 3

Answer №2

There appears to be a bug within the framework related to the cast to DefaultHttpFilters.java. For more information, you can visit this link.

Ensure that you refer to the guide available at .

To address this issue, avoid using the default implementation of DefaultHttpFilters and instead implement the code provided below:

package filters;
import play.http.*;

import java.util.Arrays;

import play.mvc.EssentialFilter;

/**
 * Helper class with a varargs constructor for filters.
 */
public class MyDefaultHttpFilters implements HttpFilters {

  private final EssentialFilter[] filters;

  public MyDefaultHttpFilters(play.api.mvc.EssentialFilter... filters) {
    this.filters = Arrays.stream(filters).map(f -> f.asJava()).toArray(EssentialFilter[]::new);
  }

  @Override
  public EssentialFilter[] filters() {
    return filters;
  }
}

Your Filter class should be structured as shown below:

import javax.inject.*;
import play.mvc.EssentialFilter;
import play.filters.cors.CORSFilter;
import filters.MyDefaultHttpFilters;

public class Filters extends MyDefaultHttpFilters {
    @Inject public Filters(CORSFilter corsFilter) {
        super(corsFilter);
    }
}

Answer 4

There appears to be a bug within the framework related to the cast to DefaultHttpFilters.java. For more information, you can visit this link.

Ensure that you refer to the guide available at .

To address this issue, avoid using the default implementation of DefaultHttpFilters and instead implement the code provided below:

package filters;
import play.http.*;

import java.util.Arrays;

import play.mvc.EssentialFilter;

/**
 * Helper class with a varargs constructor for filters.
 */
public class MyDefaultHttpFilters implements HttpFilters {

  private final EssentialFilter[] filters;

  public MyDefaultHttpFilters(play.api.mvc.EssentialFilter... filters) {
    this.filters = Arrays.stream(filters).map(f -> f.asJava()).toArray(EssentialFilter[]::new);
  }

  @Override
  public EssentialFilter[] filters() {
    return filters;
  }
}

Your Filter class should be structured as shown below:

import javax.inject.*;
import play.mvc.EssentialFilter;
import play.filters.cors.CORSFilter;
import filters.MyDefaultHttpFilters;

public class Filters extends MyDefaultHttpFilters {
    @Inject public Filters(CORSFilter corsFilter) {
        super(corsFilter);
    }
}

Answer 5

Answer №3

It may be necessary to include a CORS allow header on your server:

response.setHeader("Access-Control-Allow-Origin", "*");//cross domain request/CORS

If you're unsure what framework you're using, look for access to the response object and add something like this.

In addition, many clients conduct an http OPTIONS request prior to the actual request in order to verify supported options and server accessibility. If you detect that the http method is OPTIONS, you can simply output the headers and close the socket/connection without processing the full request.

Answer 6

It may be necessary to include a CORS allow header on your server:

response.setHeader("Access-Control-Allow-Origin", "*");//cross domain request/CORS

If you're unsure what framework you're using, look for access to the response object and add something like this.

In addition, many clients conduct an http OPTIONS request prior to the actual request in order to verify supported options and server accessibility. If you detect that the http method is OPTIONS, you can simply output the headers and close the socket/connection without processing the full request.

Answer 7

Answer №4

This information is well documented.

You can set up the filter configuration in the application.conf file. Here's an example:

play.filters.cors {
  pathPrefixes = ["/some/path", ...]
  allowedOrigins = ["http://www.example.com", ...]
  allowedHttpMethods = ["GET", "POST"]
  allowedHttpHeaders = ["Accept"]
  preflightMaxAge = 3 days
}

play.filters {
    cors {
    # Filter paths by a whitelist of path prefixes
    pathPrefixes = ["/"]

    # The allowed origins. If null, all origins are allowed.
    allowedOrigins = null

    # The allowed HTTP methods. If null, all methods are allowed
    allowedHttpMethods = ["GET", "POST", "OPTIONS"]

    preflightMaxAge = 3 days
  }
}

Answer 8

This information is well documented.

You can set up the filter configuration in the application.conf file. Here's an example:

play.filters.cors {
  pathPrefixes = ["/some/path", ...]
  allowedOrigins = ["http://www.example.com", ...]
  allowedHttpMethods = ["GET", "POST"]
  allowedHttpHeaders = ["Accept"]
  preflightMaxAge = 3 days
}

play.filters {
    cors {
    # Filter paths by a whitelist of path prefixes
    pathPrefixes = ["/"]

    # The allowed origins. If null, all origins are allowed.
    allowedOrigins = null

    # The allowed HTTP methods. If null, all methods are allowed
    allowedHttpMethods = ["GET", "POST", "OPTIONS"]

    preflightMaxAge = 3 days
  }
}

Implementing Cross-Origin Resource Sharing (CORS) in play-framework version 2.5.x: A Step-by-Step Guide

Answer №1

Answer №2

Answer №3

Answer №4

Similar questions

Discovering the art of line breaks

Inconsistently, Android WebView fails to register touch inputs

React - The select component has received an invalid value of `undefined` that is out of range

Express get requests are failing to handle query strings

Best practices for managing several models within the Ionic framework using PouchDB?

Having trouble loading items in a <select> tag with Jquery?

Passing props to children in the Next JS Layout component is a crucial aspect of

Where can I locate htmlWebpackPlugin.options.title in a Vue CLI 3 project or how can I configure it?

How to Retrieve Correct JSON Data from Mongoose Query in Node.js

The error encountered with react createRef was caused by a faulty implementation

AngularJS - Troubleshooting: Why Directive is Unable to Access Ancestor's Required Controller

Tips for combining HTML and JavaScript on a WordPress site

Utilizing Scrollify for seamless section scrolling with overflow effects

What steps can I take to ensure that the full tingle modal, which includes an image, is visible when the

I'm looking for a way to track the progress of an ajax call. Specifically, I want to know how I

What causes certain webpack / Babel ES6 imports without a specified extension to resolve as "undefined"?

Is there a way to transmit the ENTER key press to the page setup dialog within Internet Explorer 7?

Having difficulty installing the yarn package from GitHub

What is the process for utilizing datePipe in an Angular component?

What could be causing the server to not successfully receive the ajax request?