Because our GeoServer is hosted at a different origin than our web application (a different port is enough to make a domain be considered by a browser to be a different origin; an origin is a combination of protocol, host, and port), we will not be able to perform AJAX requests straight away as the browser will refuse to retrieve the data from such a location. This is due to the same-origin policy that is meant to prevent scripts from untrusted sources gaining access to the DOM of a page.

CORS (Cross Origin Resource Sharing) is a standard mechanism for cross origin communication between browsers and servers. The CORS specification defines a set of headers that are used to communicate which operations are allowed. Thanks to that, it is possible to expose APIs that can be consumed by web clients located in different domains than the API itself.

In order to enable our web apps to send AJAX requests to our remote GeoServer, we need to enable CORS in our Jetty server. In order to do so, first we need to check the version of Jetty bundled with our GeoServer. You can check it by looking at the Jetty JAR files located in the geoserver/lib directory. In my case, it is Jetty 9.2.13.v20150730. Next, we need to obtain an appropriate servlets file from http://repo1.maven.org/maven2/org/eclipse/jetty/jetty-servlets/. In my case, it was http://repo1.maven.org/maven2/org/eclipse/jetty/jetty-servlets/9.2.13.v20150730/jetty-servlets-9.2.13.v20150730.jar. Once downloaded, the servlets JAR file should be put in webapps/geoserver/WEB-INF/lib. The last step is to modify webapps/geoserver/WEB-INF/web.xml and add the following XML (I have put the mine just after the context-param declarations and before the first filter declaration):

<filter> 
    <filter-name>cross-origin</filter-name> 
    <filter-class>org.eclipse.jetty.servlets.CrossOriginFilter</filter-class> 
</filter> 
<filter-mapping> 
    <filter-name>cross-origin</filter-name> 
    <url-pattern>/*</url-pattern> 
</filter-mapping> 

At this stage, our server should be CORS-enabled and our cross origin AJAX examples should work as expected without having to use a pass-through proxy in order to connect to a service located in a different domain.