cross origin requests are blocked in tomcat 8 with HTTP status code 403
<p>it may seem like a known issue and many questions exist on the topic, however, my situation is very strange. I have a simple web application that is deployed on tomcat 8.0.36. I have configured the CORS properly:</p>

<pre><code>&lt;filter&gt;
&lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
&lt;filter-class&gt;org.apache.catalina.filters.CorsFilter&lt;/filter-class&gt;
&lt;/filter&gt;
&lt;filter-mapping&gt;
&lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
&lt;url-pattern&gt;/*&lt;/url-pattern&gt;
&lt;/filter-mapping&gt;
</code></pre>

<p>The cross-origin requests are blocked by the browser:</p>

<p>No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '<a href="https://www.mytestpage.com" rel="noreferrer">https://www.mytestpage.com</a>' is therefore not allowed access. The response had HTTP status code 403.</p>

<p>In the tomcat log file I also see the response code of 403. What is interesting is that the code of my application is never executed in case of cross-origin requests. The requests are blocked before reaching my application and 403 is sent immediately. I have no apache in front of tomcat, it's plain tomcat. I have tried many things, including whitelisting the origins and specifying allowed headers - nothing helped. I've also tried to set the header programmatically until I found that the code in case of cross-origin request is never executed.</p>

<p>UPD: The end point accepts POST requests. Those POST requests are sent as XmlHttpRequests from the JS snippet.   </p>

<p>Any ideas what it can be?</p>

<p>p.s I can make successful same origin requests.</p>