Pre-flight OPTIONS request failing over HTTPS

Question

A CORS POST request (AJAX) made by my client server (running on Apache @ port 443) to my REST server (running on Tomcat @ port 8443), fails to trigger when tried over HTTPS.

Please note that all the requests function properly without SSL.

I have already set the withCredentials: true options in the request fields. And my Tomcat server also takes care of the appropriate headers :

response.addHeader("Access-Control-Allow-Origin", "https://localhost");
response.addHeader("Access-Control-Allow-Credentials", "true");
response.addHeader("Access-Control-Allow-Headers", "Content-Type");
response.addHeader("Access-Control-Allow-Methods", "OPTIONS, POST");

I also tried using Curl, but the issue persisted over SSL. However, the Tomcat server responds to all my requests when tried directly over Postman/through the browser.

Could someone tell me what I'm missing out here?

Answer 1

I'm assuming this is an issue with the preflight request. There are two types of CORS requests: simple, and not-so-simple.

The simple kind is either a GET or POST with no custom headers whose content type is "text/plain".

The not-so-simple kind is any request using custom headers, utilising request methods other than POST or GET, and using different content body types. These requests will be "preflighted"; that is the browser will make a preflight request on the clients behalf in order to determine whether or not the server will allow this request. The preflight request uses the OPTIONS method. I'm willing to bet if you use something like Firebug to have a look what's going on you'll see something like this in the Net tab: "OPTIONS activity" with a status of "Aborted".

Unfortunately the preflight request doesn't pass the client certificate to the server which is why your request is failing to trigger. You need to disable two way SSL in order to get it working. In Apache you can try changing the SSLVerifyClient to:

SSLVerifyClient optional

I've used this before in order to get my cross domain AJAX calls working over HTTPS.

Good luck.