Atmosphere/atmosphere — Issue #204: Incorrect Access-Control-Allow-Origin Headers on Credentialed CORS request
Author: mattkrae34
Created: 2012-03-02 17:04:33+00:00
State: open

There is an issue with the headers returned from jersey/AtmosphereFilter and the AtmosphereResourceImpl class when a CORS request is sent withCredentials=true

CORS Spec
http://dvcs.w3.org/hg/cors/raw-file/tip/Overview.html#resource-requests

If the resource supports credentials add a single Access-Control-Allow-Origin header, with the value of the Origin header as value, and add a single Access-Control-Allow-Credentials header with the case-sensitive string "true" as value.

Otherwise, add a single Access-Control-Allow-Origin header, with either the value of the Origin header or the string "*" as value.

IMPORTANT PART:
The string "*" cannot be used for a resource that supports credentials.

AtmosphereResourceImpl.java

if (writeHeaders && enableAccessControl) {
response.setHeader(ACCESS_CONTROL_ALLOW_ORIGIN, "*");
response.setHeader(ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
}

AtmosphereFilter.java
if (enableAccessControl) {
b = b.header(ACCESS_CONTROL_ALLOW_ORIGIN, "*");
b = b.header(ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
}

I think the correct header setting would be:
response.setHeader(ACCESS_CONTROL_ALLOW_ORIGIN, req.getHeader("Origin"));