OIDC Plugin - CORS Preflight Did Not Succeed at OPTIONS request on userinfo_endpoint

[Daniel Lutz]

Hi Rene,

Rene Zeipelt <zeipelt at uni-wuppertal.de> wrote:
 > is the OIDC plugin supporting CORS for the userinfo endpoint? We stuck
 > on an "forbidden" error for a OPTIONS request on
 > "/idp/profile/oidc/userinfo" (with the angular-oauth2-oidc lib).

Henri Mikkonen schrieb/wrote (08.12.21 13:38):
> The plugin doesn't currently have any configuration options for this, so you need to modify web.xml to include desired CORS headers to the desired endpoints. The location from which the Javascript is performing the preflight request should be included in allowed origins.

We currently use this configuration for Tomcat in our web.xml file to temporarily solve this problem:

     <!-- CORS filter for OIDC. Needed to make preflight requests work. (Without it, Spring would deny the request with HTTP status 403.) -->
     <filter>
       <filter-name>CorsFilter</filter-name>
       <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
       <init-param>
         <param-name>cors.allowed.origins</param-name>
         <!-- Regular expressions matching all allowed RPs -->
         <param-value>^http(s)?://(.+\.)?(rp1\.example\.org|rp2\.example\.org|...)(:[0-9]+)?$</param-value>
       </init-param>
     </filter>

     <!-- CORS filter for OIDC. Map to all OIDC service locations. See the corresponding <filter> element above for details. -->
     <filter-mapping>
       <filter-name>CorsFilter</filter-name>
       <url-pattern>/profile/oidc/*</url-pattern>
     </filter-mapping>

rp1.example.org, rp2.example.org etc. correspond to the actual RPs' domains (origins) we allow.
We currently think that explicitly listing all allowed RPs is sensible, but its not
a very flexible solution yet.

   Daniel