oidc userinfo endpoint blocking OPTIONS requests

[Tevon Hastings]

Hello all,

We are trying to set up a browser based application to authenticate via the
PKCE flow of OIDC. The problem we are having is that when the browser sends
a preflight CORS request to the userinfo endpoint (which is an OPTIONS
request) it gets a 403 response. The origin is allowed by the idp. As far
as I can tell, it doesn't like the request method. I've checked web.xml but
I don't see anything that looks like it would block the requests. Any
help would be appreciated.

Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210202/aca9c97b/attachment.htm>