CORS issues - Solution proposal

[spassignat]

Is your feature request related to a problem? Please describe. Actually when using plantuml as a service server to convert plantuml to image, several kind of CORS error are raised.

Describe the solution you'd like We should be able to setup CORS during the deployment wihtout rebuilding entirely the application, or modifying the deployment directory content.

Proposal I only consider a deployment in tomcat as a war file. It's really JEE so I can be transposed to jetty. I hope this helps. At least it works as I "like", but maybe not as everybody like.

How to setup CORS Use a .xml file in the conf/Catalina/localhost add variables to the JNDI which is accessible from Servlets.

<Context>
    <Environment type="java.lang.String" name="Access-Control-Allow-Origin" value="http://localhost:5173" />
    <Environment type="java.lang.String" name="Access-Control-Allow-Headers" value="Authorization" />
    <Environment type="java.lang.String" name="Access-Control-Allow-Methods" value="PUT, HEAD, POST, GET, DELETE, OPTIONS" />
    <Environment type="java.lang.String" name="Access-Control-Allow-Credentials" value="true" />
</Context>

Where to implement

1. I would add a Filter in the web.xml, before all other servlets.

   <filter>
       <filter-name>Cors</filter-name>
       <filter-class>net.sourceforge.plantuml.servlet.CorsFilter</filter-class>
   </filter>
   <filter-mapping>
       <filter-name>Cors</filter-name>
       <url-pattern>/*</url-pattern>
   </filter-mapping>

2. Implements the filter

In the following code the default values need to be changed to match the desired default behaviour.

    protected void doFilter(HttpServletRequest req, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
        ServletContext context = getServletContext();
        String origin = context.getInitParameter("Access-Control-Allow-Origin");
        response.setHeader("Access-Control-Allow-Origin", origin != null ? origin : "http://localhost:5173");
        String headers = context.getInitParameter("Access-Control-Allow-Headers");
        response.setHeader("Access-Control-Allow-Headers", headers != null ? headers : "Authorization");
        String cred = context.getInitParameter("Access-Control-Allow-Credentials");
        response.setHeader("Access-Control-Allow-Credentials", cred != null ? cred : "true");
        String methods = context.getInitParameter("Access-Control-Allow-Methods");
        response.setHeader("Access-Control-Allow-Methods", methods!=null?methods:"PUT, HEAD, POST, GET, DELETE, OPTIONS");
        super.doFilter(req, response, chain);
    }

3. Remove old code Remove all previous code in DiagramResponse and servlets : response.addHeader("Access-Control-Allow-Origin", "*");
4. Add doOptions methods in servlets It does nothing but Parent servlet do introspection to know which methods are implemented and add them in the header.

   protected void doOptions(HttpServletRequest req, HttpServletResponse response) throws ServletException, IOException {
       super.doOptions(req, response);
   }