CORS is directly related to HTTP because it uses HTTP headers to determine whether a cross-origin request is safe and allowed. For more information, see HTTP Developer Guide.

<filter>
    <filter-name>CorsFilter</filter-name>
    <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
    <init-param>
        <param-name>cors.allowed.origins</param-name>
        <param-value>[ALLOWED_ORIGINS]</param-value> 
    </init-param>
    <init-param>
        <param-name>cors.allowed.methods</param-name>
        <param-value>OPTIONS,GET,POST,HEAD,PUT,DELETE</param-value>
    </init-param>
    <init-param>
        <param-name>cors.allowed.headers</param-name>
        <param-value>Authorization,appKey,x-thingworx-session,Content-Type,X-Requested-With,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,Accept</param-value>
    </init-param>
    <init-param>
        <param-name>cors.exposed.headers</param-name>
        <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>
    </init-param>
    <init-param>
        <param-name>cors.support.credentials</param-name>
        <param-value>false</param-value>
    </init-param>
    <init-param>
        <param-name>cors.preflight.maxage</param-name>
		      <param-value>10</param-value>
    </init-param>
    	<init-param>
        <param-name>cors.request.decorate</param-name>
		      <param-value>true</param-value>
    </init-param>
</filter>

<filter-mapping>
		     <filter-name>CorsFilter</filter-name>
		     <url-pattern>/*</url-pattern>
</filter-mapping>

Note the following: • Update thecors.allowed.originsparameter with the desired web address(es). • Multiple allowed origins can be specified by using a comma delimiter. For example, https://origin1.com, https://origin2.com. • * can be used exclusively to allow requests from all origins. * can only be used on its own to allow all origins. * cannot be used as part of a URI. • For environments that utilize Single Sign-on (SSO) with PingFederate, ensure that the PingFederate Runtime Server FQDN is added as an allowed origin. ◦ http://<Ping Federate FQDN>:9301 http://<Ping Federate FQDN>:9031 • Add or remove any custom headers from the cors.allowed.headers parameter as necessary. • Set cors.support.credentials to true to allow for basic authentication.

<!--   <security-constraint>
    <web-resource-collection>
      <web-resource-name>Forbidden</web-resource-name>
      <url-pattern>/*</url-pattern>
      <http-method>OPTIONS</http-method>
    </web-resource-collection>
    <auth-constraint/>
  </security-constraint> -->

<script>
var xhr = new XMLHttpRequest();

xhr.open("GET", "https://[THINGWORX_HOST]:[PORT]/Thingworx/Things", true);

xhr.setRequestHeader("appKey", "<APPLICATION_KEY>");
xhr.setRequestHeader("accept", "application/json");

xhr.send();
</script>

<APPLCATION_KEY> must be replaced with an active non-expired Application Key from the ThingWorx Platform.

<script>
var xhr = new XMLHttpRequest();

xhr.open("GET", "https://[THINGWORX_HOST]:[PORT]/Thingworx/Things", true);

xhr.setRequestHeader("Authorization", "Basic <USER_PASSWORD>");
xhr.setRequestHeader("accept", "application/json");

xhr.send();
</script>

<USER_PASSWORD> must be Base64 encoded with a colon separating the username and password. For example, the username Administrator with the password ptc123 would be entered into a Base64 encoder as Administrator:ptc123, resulting in a value of QWRtaW5pc3RyYXRvcjpwdGMxMjM=. This method is used for testing purposes only, as Base64 can be decoded to obtain the username and password value in plain text.