OIDC Plugin - CORS Preflight Did Not Succeed at OPTIONS request on userinfo_endpoint

[Daniel Lutz]

Hello

Rene Zeipelt schrieb/wrote (09.12.21 18:00):
 > the tomcat CORS filter works well. I stuck on the apache header config for doing CORS over the proxy_ajp -
 > that does not work regardless the same allowed methods, headers and origins.  Thanks to you.

OK.

Maybe the following is still useful for you or others:

Our initial configuration didn't work. We tried to use a regular expression in Tomcat CorsFilter's
cors.allowed.origins parameter, but it must be a comma-separated list of origins.

Furthermore, I needed to allow the "Authorization" header by extending the
default list of the "cors.allowed.headers" parameter. The "Authorization"
header is needed for the "UserInfo" endpoint.

This works for us (using Tomcat):

     <filter>
       <filter-name>CorsFilter</filter-name>
       <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>

       <init-param>
         <param-name>cors.allowed.origins</param-name>
         <!-- List of origins of allowed RPs (corresponding to the Redirect URIs). Comma-separated list. -->
         <param-value>
           https://client1.example.org,
           https://client2.example.org:4200
         </param-value>
       </init-param>

       <init-param>
         <param-name>cors.allowed.headers</param-name>
         <!-- Add the header "Authorization" to the default list of allowed headers -->
         <param-value>
           Origin,
           Accept,
           X-Requested-With, Content-Type,
           Access-Control-Request-Method,
           Access-Control-Request-Headers,
           Authorization
         </param-value>
       </init-param>

     </filter>

And here's the mappping we use:

     <filter-mapping>
       <filter-name>CorsFilter</filter-name>
       <url-pattern>/profile/oidc/*</url-pattern>
     </filter-mapping>


Daniel