Best way to implement method OPTIONS in REST services

Question

I'm doing a REST application. I have made the GET method without issues, however, when I implement the POST method, it says that I don't have the OPTIONS method implemented for it. I am doing the OPTIONS method for URI:

http://192.168.1.26:8080/sellAppWeb/api/object/

I have the POST and OPTIONS methods:

@OPTIONS
@Produces("application/json; charset=UTF-8")
public Response options() {
    return Response.ok().build();
}

@Override
@POST
public Response save(CervejaDTO cervejaDTO) {
    cervejaController.register(cervejaDTO);
    return Response.ok(cervejaDTO).build();
}

Then I am made the DELETE method and again it says that I don't have a OPTIONS method. Then I need to make another OPTIONS method, which has an ID in the URI end. For example to delete a object with id = 3:

http://192.168.1.26:8080/sellAppWeb/api/object/3

I need to have another OPTIONS with same structure of DELETE URI:

@OPTIONS
@Path("/{id}")
@Produces("application/json; charset=UTF-8")
public Response optionsDelete(@PathParam("id") Integer id) {
    return Response.ok().build();
}

@Override
@POST
public Response save(CervejaDTO cervejaDTO) {
    cervejaController.register(cervejaDTO);
    return Response.ok(cervejaDTO).build();
}

Does anyone have a way to do a generic OPTIONS for all REST requests?

the web.xml:

<display-name>Testes de serviços REST</display-name>
<description>Testes de serviços REST</description>

<welcome-file-list>
    <welcome-file>index.html</welcome-file>
</welcome-file-list>

<context-param>
    <param-name>resteasy.scan</param-name>
    <param-value>true</param-value>
</context-param>

<context-param>
    <param-name>resteasy.servlet.mapping.prefix</param-name>
    <param-value>/api</param-value>
</context-param>

<context-param>
    <param-name>resteasy.providers</param-name>
    <param-value>br.com.sell.app.exception.handler.DefaultExceptionHandler</param-value>
</context-param>

<listener>
    <listener-class>org.jboss.resteasy.plugins.server.servlet.ResteasyBootstrap</listener-class>
</listener>

<servlet>
    <servlet-name>resteasy-servlet</servlet-name>
    <servlet-class>org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher</servlet-class>
</servlet>

<servlet-mapping>
    <servlet-name>resteasy-servlet</servlet-name>
    <url-pattern>/api/*</url-pattern>
</servlet-mapping>

Answer 1

You don't need to implements the OPTIONS HTTP VERB in this case. Since you're using RESTEasy, which is the JAX-RS implementation used by Wildfly, the issue I encountered was due to the servlet-mapping on web.xml.

I have encountered this when I added the JAX-RS facet on Eclipse and tell it to update the web.xml. The default generated web.xml containing the Restful application mapping doesn't map your application properly to your RESTful resource path.

This is how the web.xml should look like, provided you have not created your own custom Application.

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://xmlns.jcp.org/xml/ns/javaee"
    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
    version="3.1">
    <display-name>My REST API</display-name>
    <description>My REST API</description>
    <servlet>
        <description>JAX-RS Tools Generated - Do not modify</description>
        <servlet-name>javax.ws.rs.core.Application</servlet-name>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>javax.ws.rs.core.Application</servlet-name>
        <url-pattern>/jaxrs/*</url-pattern>
    </servlet-mapping>
</web-app>

Make sure that your <servlet-name> and <servlet-mapping> are mapped as in the example above. If you extended the Application class, just specify it in your web.xml instead of the default Application as shown above.

Also, your @POST resource method, it's recommended to specify the resource type of your RESTful data (in your case, your DTO) using @Consumes annotation.

Eg.

@POST
@Path("/save")
@Consumes({MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML})
@Produces({MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML})
public Response save(CervejaDTO cervejaDTO)

}

Answer 2

"however, when I implement the POST method, it says that I don't have the OPTIONS method implemented for it."

"When i make a POST or DELTE request, the application make automatically a OPTIONS request before"

This definitely sound like a CORS (Cross Origin Resource Sharing) problem. You can read more about it at HTTP access control (CORS). Basically the OPTIONS request is preflight request before the actual request. This will happen for certain types of AJAX requests.

For this, RESTeasy has the CorsFilter you can register. You need to configure the filter to the settings you want to allow. Also see an example here for one way to configure it.

Answer 3

I tried RestEasy's CorsFilter but calls made with the OPTIONS method were returning

RESTEASY003655: No resource method found for options, return OK with Allow header

I wrote a simple filter that:

1. Makes sure the CORS header you need are applied to the response.
2. Returns the HTTP status code 200 when calling an endpoint with the OPTIONS method. You just tell the client that its CORS preflight requests was accepted.

Here is the code. This is a simplified version, ditry - yet efficient. Feel free to refine the filter if you only want to send back a 200 when querying a "real" endpoint.

@Provider 
public class CorsFilter implements ContainerResponseFilter {  

  @Override
  public void filter(ContainerRequestContext requestContext, ContainerResponseContext responseContext) throws IOException {
    MultivaluedMap<String, Object> headers = responseContext.getHeaders();
    headers.add("Access-Control-Allow-Origin", "*"); // If you want to be more restrictive it could be localhost:4200
    headers.add("Access-Control-Allow-Methods", "GET, PUT, POST, OPTIONS"); // You can add HEAD, DELETE, TRACE, PATCH
    headers.add("Access-Control-Allow-Headers", "Content-Type, Authorization, Accept, Accept-Language"); // etc

    if (requestContext.getMethod().equals("OPTIONS"))
        responseContext.setStatus(200);
}}

From this post and my preferred CORS explanation.

Answer 4

You can use @Path("{path:.*}").

@OPTIONS
@Path("{path:.*}")
public Response handleCORSRequest() throws Exception {
    Response.ResponseBuilder builder = Response.ok();
    return builder.build();
}

Answer 5

I recommend you to use Spring Controllers and RequestMapping annotations, they are really easy to use:

@RequestMapping(value="/method0", method="POST")
@ResponseBody
public String method0(){
    return "method0";
}

You dont need to implement OPTIONS methods, just declare your method and use the annotation to define it as a POST/GET/PUT/DELETE request method. Here are lots of examples.

Answer 6

For me that was the only way to do work.

Create the class in your java restclient project.

    import javax.ws.rs.core.Context;
    import javax.ws.rs.core.HttpHeaders;
    import javax.ws.rs.core.Response;
    import javax.ws.rs.core.Response.ResponseBuilder;
    import javax.ws.rs.ext.ExceptionMapper;
    import javax.ws.rs.ext.Provider;

    import org.jboss.resteasy.spi.DefaultOptionsMethodException;

    @Provider
    public class OptionsHander implements
         ExceptionMapper<DefaultOptionsMethodException> {

    private static final String ACCESS_CONTROL_REQUEST_HEADERS = "Access-Control-Request-Headers";
    private static final String ACCESS_CONTROL_REQUEST_METHOD = "Access-Control-Request-Method";

    private static final String ACCESS_CONTROL_ALLOW_HEADERS = "Access-Control-Allow-Headers";
    private static final String ACCESS_CONTROL_ALLOW_METHODS = "Access-Control-Allow-Methods";
    private static final String ACCESS_CONTROL_ALLOW_ORIGIN = "Access-Control-Allow-Origin";

    private static final String ACCESS_CONTROL_ALLOW_ORIGIN_ANYONE = "*";

    @Context HttpHeaders httpHeaders;

    @Override
    public Response toResponse(DefaultOptionsMethodException exception) {

        final ResponseBuilder response = Response.ok();

        String requestHeaders = httpHeaders.getHeaderString(ACCESS_CONTROL_REQUEST_HEADERS);
        String requestMethods = httpHeaders.getHeaderString(ACCESS_CONTROL_REQUEST_METHOD);

        if (requestHeaders != null)
            response.header(ACCESS_CONTROL_ALLOW_HEADERS, requestHeaders);

        if (requestMethods != null)
            response.header(ACCESS_CONTROL_ALLOW_METHODS, requestMethods);

        // TODO: development only, too permissive
        response.header(ACCESS_CONTROL_ALLOW_ORIGIN, ACCESS_CONTROL_ALLOW_ORIGIN_ANYONE);

        return response.build();
    }
}