Cross-Domain REST API Cannot Login, Receive HTTP 415

[Robert Liao]

I am trying to get my browser to login to JIRA using the rest api:

function logIntoJira()
{
    var loginObject =             
       {
           "username": "racuit",
           "password": "test"
       };

    var xhr = new XMLHttpRequest();

    xhr.onreadystatechange = function()
        {
            if ((xhr.readyState == 4) && (xhr.status == 200))
            {
            }
        };
    xhr.open("POST", "http://racuitjira:8080/rest/auth/1/session");

    xhr.setRequestHeader("Content-type", "application/json");

    xhr.send(JSON.stringify(loginObject));
}

The JS above lives on racuitweb, and jira lives on racuitjira. I've enabled Cors=filter-1.5 (Added config entries, but there's no logging to show that it loaded). However, I keep receiveing 415's from Firefox and Chrome.

HTTP/1.1 415 Unsupported Media Type (text/html)

Now, I can directly get things to work fine with curl. What else am I missing here?

This is on Jira 5.2.1 Standalone

Jira's catalina.out file shows

Jan 16, 2013 4:37:10 PM com.sun.jersey.spi.container.ContainerRequest getEntity
SEVERE: A message body reader for Java class com.atlassian.jira.rest.auth.AuthParams, and Java type class com.atlassian.jira.rest.auth.AuthParams, and MIME media type application/octet-stream was not found.
The registered message body readers compatible with the MIME media type are:
*/* ->
  com.sun.jersey.core.impl.provider.entity.FormProvider
  com.sun.jersey.core.impl.provider.entity.StringProvider
  com.sun.jersey.core.impl.provider.entity.ByteArrayProvider
  com.sun.jersey.core.impl.provider.entity.FileProvider
  com.sun.jersey.core.impl.provider.entity.InputStreamProvider
  com.sun.jersey.core.impl.provider.entity.DataSourceProvider
  com.sun.jersey.core.impl.provider.entity.XMLJAXBElementProvider$General
  com.sun.jersey.core.impl.provider.entity.ReaderProvider
  com.sun.jersey.core.impl.provider.entity.DocumentProvider
  com.sun.jersey.core.impl.provider.entity.SourceProvider$StreamSourceReader
  com.sun.jersey.core.impl.provider.entity.SourceProvider$SAXSourceReader
  com.sun.jersey.core.impl.provider.entity.SourceProvider$DOMSourceReader
  com.sun.jersey.json.impl.provider.entity.JSONJAXBElementProvider$General
  com.sun.jersey.core.impl.provider.entity.XMLRootElementProvider$General
  com.sun.jersey.core.impl.provider.entity.XMLListElementProvider$General
  com.sun.jersey.core.impl.provider.entity.XMLRootObjectProvider$General
  com.sun.jersey.core.impl.provider.entity.EntityHolderReader
  com.sun.jersey.json.impl.provider.entity.JSONRootElementProvider$General
  com.sun.jersey.json.impl.provider.entity.JSONListElementProvider$General
  com.sun.jersey.json.impl.provider.entity.JacksonProviderProxy
application/octet-stream ->
  com.sun.jersey.core.impl.provider.entity.ByteArrayProvider
  com.sun.jersey.core.impl.provider.entity.FileProvider
  com.sun.jersey.core.impl.provider.entity.InputStreamProvider
  com.sun.jersey.core.impl.provider.entity.DataSourceProvider
  com.sun.jersey.core.impl.provider.entity.RenderedImageProvider

2013-01-16 16:37:10,546 http-bio-8080-exec-8 ERROR anonymous 997x5x1 - 172.16.250.146 /rest/auth/1/session [jersey.spi.container.ContainerRequest] A message body reader for Java class com.atlassian.jira.rest.auth.AuthParams, and Java type class com.atlas$
The registered message body readers compatible with the MIME media type are:
*/* ->
  com.sun.jersey.core.impl.provider.entity.FormProvider
  com.sun.jersey.core.impl.provider.entity.StringProvider
  com.sun.jersey.core.impl.provider.entity.ByteArrayProvider
  com.sun.jersey.core.impl.provider.entity.FileProvider
  com.sun.jersey.core.impl.provider.entity.InputStreamProvider
  com.sun.jersey.core.impl.provider.entity.DataSourceProvider
  com.sun.jersey.core.impl.provider.entity.XMLJAXBElementProvider$General
  com.sun.jersey.core.impl.provider.entity.ReaderProvider
  com.sun.jersey.core.impl.provider.entity.DocumentProvider
  com.sun.jersey.core.impl.provider.entity.SourceProvider$StreamSourceReader
  com.sun.jersey.core.impl.provider.entity.SourceProvider$SAXSourceReader
  com.sun.jersey.core.impl.provider.entity.SourceProvider$DOMSourceReader
  com.sun.jersey.json.impl.provider.entity.JSONJAXBElementProvider$General
  com.sun.jersey.core.impl.provider.entity.XMLRootElementProvider$General
  com.sun.jersey.core.impl.provider.entity.XMLListElementProvider$General
  com.sun.jersey.core.impl.provider.entity.XMLRootObjectProvider$General
  com.sun.jersey.core.impl.provider.entity.EntityHolderReader
  com.sun.jersey.json.impl.provider.entity.JSONRootElementProvider$General
  com.sun.jersey.json.impl.provider.entity.JSONListElementProvider$General
  com.sun.jersey.json.impl.provider.entity.JacksonProviderProxy
application/octet-stream ->
  com.sun.jersey.core.impl.provider.entity.ByteArrayProvider
  com.sun.jersey.core.impl.provider.entity.FileProvider
  com.sun.jersey.core.impl.provider.entity.InputStreamProvider

com.sun.jersey.core.impl.provider.entity.DataSourceProvider

com.sun.jersey.core.impl.provider.entity.RenderedImageProvider

Browser Packet Exchange:

First Request (We never get to the POST)

OPTIONS /rest/auth/1/session HTTP/1.1
Host: racuitjira:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20100101 Firefox/17.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Origin: http://racuitdev
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Pragma: no-cache
Cache-Control: no-cache

Response

HTTP/1.1 415 Unsupported Media Type
Server: Apache-Coyote/1.1
X-AREQUESTID: 997x5x1
Set-Cookie: atlassian.xsrf.token=XXXXX; Path=/
X-AUSERNAME: anonymous
Cache-Control: no-cache, no-store, no-transform
Content-Type: text/html;charset=utf-8
Content-Length: 1117
Date: Thu, 17 Jan 2013 00:37:10 GMT

[Robert Liao · Accepted solution]

It turns out, it's not sufficient to have cors-filter configured in JIRA's Tomcat web.xml. The cors-filter must be before all of the jira filters, otherwise it won't have a chance to handle the CORS request.

[Renjith Pillai]

Change "Content-type" to "Content-Type" - just an attempt, not sure though.

[Robert Liao]

I had that in an earlier iteration. Doesn't work.