title: CORS failing when POST request has no body and server response is a 403 Forbidden error
body: <p>The application I am working on sends a request from an apache server running on localhost:80 to a tomcat server running on localhost:8080 this is creating a cross origin scenario. When the application sends a POST request with a body the pre-flight request is sent, the response contains all of the headers necessary and then the actual request is sent and it shows success. If I send the same request without a body there is no pre-flight request sent and I receive the </p>
  
  <blockquote>
    <p>'Access to XMLHttpRequest at '<a href="http://localhost:8080/webapp/api" rel="nofollow noreferrer">http://localhost:8080/webapp/api</a>' from origin '<a href="http://localhost" rel="nofollow noreferrer">http://localhost</a>' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.</p>
  </blockquote>
  
  <p>I have added the CORS filter to Tomcat and have it configured:</p>
  
  <pre><code>        &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
          &lt;filter-class&gt;org.apache.catalina.filters.CorsFilter&lt;/filter-class&gt;
          &lt;init-param&gt;
            &lt;param-name&gt;cors.allowed.origins&lt;/param-name&gt;
            &lt;param-value&gt;http://localhost&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
           &lt;param-name&gt;cors.supportedMethods&lt;/param-name&gt;
              &lt;param-value&gt;GET, POST, HEAD, PUT, DELETE&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;cors.support.credentials&lt;/param-name&gt;
              &lt;param-value&gt;true&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;cors.allowed.headers&lt;/param-name&gt;
              &lt;param-value&gt;Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;cors.exposed.headers&lt;/param-name&gt;
              &lt;param-value&gt;Access-Control-Allow-Origin,Access-Control-Allow-Credentials&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;cors.preflight.maxage&lt;/param-name&gt;
              &lt;param-value&gt;10&lt;/param-value&gt;
          &lt;/init-param&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>Here are some fiddler outputs:
  Without the body in the post</p>
  
  <p><strong>Request</strong></p>
  
  <pre><code>POST http://localhost:8080/webapp/api/cart/promoremove/null?school=localhost HTTP/1.1
  Host: localhost:8080
  Connection: keep-alive
  Content-Length: 0
  Accept: application/json, text/plain, */*
  Origin: http://localhost
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
  Sec-Fetch-Site: same-site
  Sec-Fetch-Mode: cors
  Referer: http://localhost/cart-home
  Accept-Encoding: gzip, deflate, br
  Accept-Language: en-US,en;q=0.9
  Cookie: JSESSIONID=DF1A170A1B38AD7B2EFDC70A742027B8; hazelcast.sessionId=HZ90788223E83048308A167BE8514D5649; NG_TRANSLATE_LANG_KEY=%22en%22; JSESSIONID=205B812430E4261E2E2999AED6652E1D; liveagent_oref=; liveagent_ptid=4a8955a7-df01-4e22-8f77-16cabf542a11; liveagent_sid=95a17ee7-44da-480e-9f80-0fce17de4ecb; liveagent_vc=3; SESS49960de5880e8c687434170f6476605b=tumGvaRrAVNtDjAwOmMVuNivVnoZLt3muLr8KjAcyj4; ceshopCartUUID=null
  </code></pre>
  
  <p><strong>Response</strong></p>
  
  <pre><code>HTTP/1.1 403 Forbidden
  Server: Apache-Coyote/1.1
  Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE
  Access-Control-Max-Age: 3600
  Access-Control-Allow-Headers: origin,x-requested-with,access-control-request-headers,content-type,access-control-request-method,accept
  X-Content-Type-Options: nosniff
  X-XSS-Protection: 1; mode=block
  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  Pragma: no-cache
  Expires: 0
  X-Application-Context: application:dev:8080
  Content-Type: text/plain;charset=UTF-8
  Date: Thu, 05 Dec 2019 22:59:59 GMT
  Content-Length: 0 
  </code></pre>
  
  <p>and with a body</p>
  
  <p><strong>Request</strong></p>
  
  <pre><code>POST http://localhost:8080/webapp/api/cart/promoremove/null?school=localhost HTTP/1.1
  Host: localhost:8080
  Connection: keep-alive
  Content-Length: 15
  Accept: application/json, text/plain, */*
  Origin: http://localhost
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
  Content-Type: application/json;charset=UTF-8
  Sec-Fetch-Site: same-site
  Sec-Fetch-Mode: cors
  Referer: http://localhost/cart-home
  Accept-Encoding: gzip, deflate, br
  Accept-Language: en-US,en;q=0.9
  Cookie: JSESSIONID=DF1A170A1B38AD7B2EFDC70A742027B8; hazelcast.sessionId=HZ90788223E83048308A167BE8514D5649; NG_TRANSLATE_LANG_KEY=%22en%22; JSESSIONID=205B812430E4261E2E2999AED6652E1D; liveagent_oref=; liveagent_ptid=4a8955a7-df01-4e22-8f77-16cabf542a11; liveagent_sid=95a17ee7-44da-480e-9f80-0fce17de4ecb; liveagent_vc=3; SESS49960de5880e8c687434170f6476605b=tumGvaRrAVNtDjAwOmMVuNivVnoZLt3muLr8KjAcyj4; ceshopCartUUID=null
  
  {"some":"body"}
  </code></pre>
  
  <p><strong>Response</strong></p>
  
  <pre><code>HTTP/1.1 200 OK
  Server: Apache-Coyote/1.1
  Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE
  Access-Control-Max-Age: 3600
  Access-Control-Allow-Headers: origin,x-requested-with,access-control-request-headers,content-type,access-control-request-method,accept
  X-Content-Type-Options: nosniff
  X-XSS-Protection: 1; mode=block
  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  Pragma: no-cache
  Expires: 0
  X-Application-Context: application:dev:8080
  Access-Control-Allow-Origin: http://localhost
  Access-Control-Allow-Credentials: true
  Access-Control-Expose-Headers: Access-Control-Allow-Origin,Access-Control-Allow-Credentials
  Content-Type: application/json;charset=UTF-8
  Transfer-Encoding: chunked
  Date: Thu, 05 Dec 2019 23:08:34 GMT
  
  b75
  {"cartUUID":null}
  </code></pre>
  
  <p>So, does anyone have any idea why the Allow-Origin-Headers are not being returned when the request has no body, and hence failing.</p>