Session gets cleared after adding cors filter in web.xml chrome browser
<p>This is my scenario:</p>

<p>I have developed a small application using angular2 which runs on node server. My rest services are deployed in tomcat server.
I used to get </p>

<pre><code>Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource
</code></pre>

<p>error when I do any post request.</p>

<p>I solved this issue by adding </p>

<pre><code>&lt;filter&gt;
    &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
    &lt;filter-class&gt;org.apache.catalina.filters.CorsFilter&lt;/filter-class&gt;
&lt;/filter&gt;
&lt;filter-mapping&gt;
    &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
    &lt;url-pattern&gt;/rest/*&lt;/url-pattern&gt;
&lt;/filter-mapping&gt;
</code></pre>

<p>in web.xml.</p>

<p>Now, the post request works properly, but the issue is, anything stored in the request session is cleared when accessed in the subsequent requests.</p>

<p>For eg. I have one login page on app startup.
When I login, I store the logged in user's id in the request session.
After login, I redirect it to home page where I try to get the logged in user's id by calling one more request service by fetching from session, but it returns null.</p>

<p>Can anyone help me solve this issue?</p>

<p>This happens with firefox and chrome browser.</p>

<p>It works fine with Edge and IE browser because they have built in cors support.</p>

<p>This is the code for calling the service:</p>

<pre><code>getLoggedInUser(){
    return this.http.get('http://localhost:8080/EmployeeReferralManagement/rest/login/get-logged-in-employee').toPromise()
   .then(res =&gt; res.json() as Employee)
   .catch(this.handleError);
}
</code></pre>

<p>This is the snapshot of web service calls:</p>

<p><a href="https://i.stack.imgur.com/JxuG6.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/JxuG6.png" alt="This is the snapshot of web service calls"></a></p>

<p>Rest service:</p>

<pre><code>@GET
@Path("/get-logged-in-employee")
public Response getLoggedInEmployee() throws Exception {
    try {
        Employee loggedInEmployee = CommonUtils.checkSession(request);
        JSONObject response = new JSONObject();
        response.put("employeeId", loggedInEmployee.getEmployeeId());
        response.put("designation", loggedInEmployee.getDesignation());
        return ResponseUtils.sendResponse(200, response.toString());
    } catch (Exception e) {
        e.printStackTrace();
        return ResponseUtils.sendResponse(500, e.getMessage());
    }
}
</code></pre>

<p>checkSession Method:</p>

<pre><code>public static Employee checkSession(HttpServletRequest request) throws Exception {
    Employee loggedInEmployee = (Employee) request.getSession().getAttribute("employee");
    if(loggedInEmployee == null)
        throw new Exception("Session Expired");
    return loggedInEmployee;
}
</code></pre>

<p>This is the snapshot of headers tab:
<a href="https://i.stack.imgur.com/ySnA2.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ySnA2.png" alt="snapshot of headers tab"></a></p>