Enabling CORS in GeoServer (jetty)?

I hope somebody has already figured this one out. I just installed Geoserver 2.9 on a vanilla Ubuntu 16.04 distro. The Geoserver 2.8 method of enabling CORS with the shanbe.hezoun class does no longer work with Jetty 9.2.13.

There are mentions that CORS support is already packaged with Jetty 9.2.13 in the jetty-servlets.jar.

The Jetty lib which is compiled with Geoserver contains a jetty-servlet-9.2.13.v20150730.jar in geoserver/lib but not jetty-servlets.9.2.13.v20150730.jar. Are these supposed to be the same jar with a different name?

It should be possible to enable CORS either in geoserver/etc/webdefault.xml or in geoserver/webapps/geoserver/WEB-INF/web.xml.

My understanding is that the webdefault.xml is applied first and the web.xml thereafter.

I have tried following filter in both xml. I haven't got as far as adding a filter mapping. Adding the filter alone will cause the Geoserver/Jetty service to not start proper.

    cross-origin
    org.eclipse.jetty.servlets.CrossOriginFilter

Answer

Edit the webapps/geoserver/WEB-INF/web.xml file. There are two references to CORS in this file:

  cross-origin
     org.eclipse.jetty.servlets.CrossOriginFilter
  

and

   cross-origin
   /*

You must uncomment both blocks (that is remove from the filter and filter-mapping blocks.

Then when you restart Jetty you can test that everything is working by using a command like:

curl -v -H "Origin: http://example.com" http://astun-desktop:9080/geoserver/wfs\?service\=WFS\&version\=2.0.0\&request\=GetFeature\&typenames\=sf:bugsites\&filter\=%3Cfes:Filter%20xmlns:fes\=%22http://www.opengis.net/fes/2.0%22%3E%3Cfes:ResourceId%20rid\=%22bugsites.3%22/%3E%3C/fes:Filter%3E

which if all is well will give a result like:

> User-Agent: curl/7.35.0

> Host: astun-desktop:9080
> Accept: */*
> Origin: http://example.com
>  
< HTTP/1.1 200 OK 
< Access-Control-Allow-Origin: http://example.com 
< Access-Control-Allow-Credentials: true 
< Access-Control-Expose-Headers:  
< Content-Type: text/xml; subtype=gml/3.2 
< Content-Disposition: inline; filename=geoserver-GetFeature.text 

< Transfer-Encoding: chunked
* Server Jetty(9.2.13.v20150730) is not blacklisted 
< Server: Jetty(9.2.13.v20150730) 
< 
* Connection #0 to host astun-desktop left intact 
590529 49146253Beetle site%

Update 24th Oct 2019

It it is no longer necessary to add the following jar to GeoServer (at least with versions 2.13.x and later) and it will cause an error. I'm leaving this note here for people fighting older versions.

1. Add the Jetty-Utility Servlets Jar to match the version of Jetty - for current versions of GeoServer (2.15.x) it is 9.4.12.v20180830, copy this to webapps/geoserver/WEB-INF/lib inside the geoserver-2.15.0 directory (or wherever you unpacked the zip file).