I’m developing a real-time GIS web app. On my Windows dev machine, I used the GeoServer Jetty binary install and enabled CORS via the official guide. This worked without any CORS issues. On my Ubuntu 24.04 server, the setup is: Apache as reverse proxy. Tomcat 9 running GeoServer. I followed the official Tomcat CORS guide but the browser still blocks requests. Current geoserver/WEB-INF/web.xml file: GeoServer GEOSERVER_CSRF_WHITELIST mydomainnnn.com serviceStrategy PARTIAL-BUFFER2 PARTIAL_BUFFER_STRATEGY_SIZE 50 ENABLE_JSONP true PROXY_BASE_URL https://mydomainnnn.com/geoserver contextConfigLocation classpath*:/applicationContext.xml classpath*:/applicationSecurityContext.xml FlushSafeFilter org.geoserver.filters.FlushSafeFilter Set Character Encoding org.springframework.web.filter.CharacterEncodingFilter encoding UTF-8 SessionDebugger org.geoserver.filters.SessionDebugFilter filterChainProxy org.springframework.web.filter.DelegatingFilterProxy securityHeadersFilter org.geoserver.filters.SecurityHeadersFilter GZIP Compression Filter org.geoserver.filters.GZIPFilter compressed-types text/.*,.*xml.*,application/json,application/javascript Advanced Dispatch Filter org.geoserver.platform.AdvancedDispatchFilter Spring Delegating Filter org.geoserver.filters.SpringDelegatingFilter Thread locals cleanup filter org.geoserver.filters.ThreadLocalsCleanupFilter cross-origin org.apache.catalina.filters.CorsFilter cors.allowed.origins * cors.allowed.methods GET,POST,PUT,DELETE,HEAD,OPTIONS cors.allowed.headers * Set Character Encoding /* cross-origin /* FlushSafeFilter /* SessionDebugger /* GZIP Compression Filter /* securityHeadersFilter /* filterChainProxy /* Advanced Dispatch Filter /* Spring Delegating Filter /* Thread locals cleanup filter /* org.geoserver.GeoserverInitStartupListener org.geoserver.logging.LoggingStartupContextListener org.geoserver.platform.GeoServerContextLoaderListener org.geoserver.platform.GeoServerHttpSessionListenerProxy org.springframework.web.context.request.RequestContextListener dispatcher org.springframework.web.servlet.DispatcherServlet dispatcher /* true COOKIE xsl text/xml sld text/xml json application/json yaml text/plain index.html Example error (chrome console): Access to fetch at 'https://sub2.sub1.mydomainnnn.com/geoserver/rest/layers.json' from origin 'https://sub1.mydomainnn.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Example error (firefox console) Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://sub2.sub1.mydomainnn.com/geoserver/rest/layers.json. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 403. What I tried so far: I followed the official Tomcat CORS guide, but it did not fix anything. Tried CORS configuration for Geoserver. Tried CORS configuration at Tomcat level. Tried other CORS configs I found online, and nothing worked. And yes, I my CSRF settings whitelists my server’s domain. Guides I tried other than the listed above: https://docs.geoserver.org/main/en/user/production/container.html#enable-cors-for-tomcat https://docs.geocat.net/geoserver-enterprise/2020.5/install/production/cors.html https://www.youtube.com/watch?v=1qrikPfLBFs https://launchcodeeducation.gitbook.io/using-geoserver-with-openlayers/rendering-data-in-openlayers/enabling-cors-in-geoserver