Skip to content

Cross-Origin Resource Sharing (CORS)

Optional: To use GeoServer outside of your domain, enable Cross-Origin Resource Sharing (CORS).

Builtin

GeoServer now includes built-in CORS handling:

  1. Navigate to Security > CORS to enable
  2. Restart is required.

Tomcat

  1. Locate Tomcat configuration conf/web.xml.

  2. Add the following filters to web.xml:

      <filter>
    <filter-name>CorsFilter</filter-name>
    <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
    <init-param>
      <param-name>cors.allowed.origins</param-name>
      <param-value>*</param-value>
    </init-param>
    <init-param>
      <param-name>cors.allowed.methods</param-name>
      <param-value>GET,POST,HEAD,OPTIONS,PUT</param-value>
    </init-param>
    <init-param>
      <param-name>cors.exposed.headers</param-name>
      <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Methods</param-value>
    </init-param>
  </filter>
  <filter-mapping>
    <filter-name>CorsFilter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>

  3. Save change to web.xml.

  4. Restart service.

Reference: