Access to XMLHttpRequest at due to CORS in complex server situation

Question

I've got two servers, both of which I control. One is a thingworx server that talks to the other, a windchill server, and displays my web page. I've got a thingworx mashup that talks to the windchill server. It pulls images and pdf from the windchill server and allows the operator of the mashup to alter the image or pdf then put it back on the server. I tackled the CORS problem presented when pulling images from the server but now I'm getting CORS errors when POSTing to the server.

I tried putting the CORS filter on the thingworx server but no joy. I had to tell the script to pull the images as crossorigin, so I'm thinking there's some proper way to ask for a crossorigin POST too.

$.ajax({
    method: 'POST',
    url: urlString,
    enctype: 'multipart/form-data',
    processData: false,
    cache: false,
    contentType: false,
    processData: false,
    type: 'POST', 
    data: fd
    //crossOrigin: true
}).done(function(data) {
    console.log('success', data) 
});

Works great with CORS checking turned off in chrome.

Answer 1

For current versions of Windchill you can configure CORS as per the following PTC Article: https://support.ptc.com/help/wnc/r12.0.0.0/en/#page/Windchill_Help_Center%2FFileVaultConfigWCforCORS.html%23

This requires CORS filters to be set in the Tomcat config of Windchill.

It seems that you are trying to move content from or to the Windchill server, hence I believe the article above should be applicable in this use case.

Summary of steps:

Configure CORS filters to allow cross-origin http requests using the following procedure. This configuration is applicable to Windchill master and file server sites.

1. Navigate to <Windchill_Home>\codebase\WEB-INF\web.xml.
2. Update web.xml file with the following ContentCorsFilter and ContentHttpHeaderSecurityFilter along with Mapping configurations:

<filter>
    <filter-name>ContentCorsFilter</filter-name>
    <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
    <init-param>
        <param-name>cors.allowed.origins</param-name>
        <param-value>[ALLOWED_ORIGINS]</param-value>
    </init-param>
    <init-param>
        <param-name>cors.support.credentials</param-name>
        <param-value>true</param-value>
    </init-param>
    <init-param>
        <param-name>cors.allowed.methods</param-name>
        <param-value>GET,POST,OPTIONS</param-value>
    </init-param>
    <init-param>
        <param-name>cors.allowed.headers</param-name>
        <param-value>Content-Type,X-Requested-With</param-value>
    </init-param>
</filter>
<filter>
    <filter-name>ContentHttpHeaderSecurityFilter</filter-name>
    <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
    <init-param>
        <param-name>antiClickJackingOption</param-name>
        <param-value>ALLOW-FROM</param-value>
    </init-param>
    <init-param>
        <param-name>antiClickJackingUri</param-name>
        <param-value>[ALLOWED_ORIGINS]</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>ContentCorsFilter</filter-name>
    <url-pattern>/servlet/WindchillAuthGW/wt.content.ContentHttp/viewContent/*</url-pattern>
    <url-pattern>/servlet/WindchillAuthGW/wt.fv.master.StandardMasterService/doDirectDownload/*</url-pattern>
    <url-pattern>/servlet/WindchillAuthGW/wt.fv.replica.StandardReplicaService/doDownload/*</url-pattern>
    <url-pattern>/servlet/WindchillAuthGW/wt.fv.replica.StandardReplicaService/doIndirectDownload/*</url-pattern>
</filter-mapping>
<filter-mapping>
    <filter-name>ContentHttpHeaderSecurityFilter</filter-name>
    <url-pattern>/servlet/WindchillAuthGW/wt.content.ContentHttp/viewContent/*</url-pattern>
    <url-pattern>/servlet/WindchillAuthGW/wt.fv.master.StandardMasterService/doDirectDownload/*</url-pattern>
    <url-pattern>/servlet/WindchillAuthGW/wt.fv.replica.StandardReplicaService/doDownload/*</url-pattern>
    <url-pattern>/servlet/WindchillAuthGW/wt.fv.replica.StandardReplicaService/doIndirectDownload/*</url-pattern>
</filter-mapping>

Update the cors.allowed.origin and antiClickJackingUri parameter with the desired web address(es) using comma separated list. Do not use asterisk (*) since cors.support.credentials is required to true.

3. Save the web.xml file.
4. Restart the Windchill server.

Please always use the latest PTC Tech Support and Help Articles for most current and up to date information as these steps may change.