oidc userinfo endpoint blocking OPTIONS requests

[Daniel Lutz]

Tevon Hastings schrieb/wrote (02.02.21 18:57):
> We are trying to set up a browser based application to authenticate via the PKCE flow of OIDC.
> The problem we are having is that when the browser sends a preflight CORS request to the userinfo
> endpoint (which is an OPTIONS request) it gets a 403 response. The origin is allowed by the idp.
> As far as I can tell, it doesn't like the request method. I've checked web.xml but I don't see
> anything that looks like it would block the requests. Any help would be appreciated.

We hit this issue too recently. I found that the 403 is probably produced by the Spring Framework.

Adding this filter to web.xml seemed to resolve the issue:

     <filter>
       <filter-name>CorsFilter</filter-name>
       <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
       <init-param>
         <param-name>cors.allowed.origins</param-name>
         <!-- Regular expressions matching all allowed RPs -->
         <param-value>^http(s)?://(.+\.)?(rp1\.example\.org|rp2\.example\.org)(:[0-9]+)?$</param-value>
       </init-param>
     </filter>

     <filter-mapping>
       <filter-name>CorsFilter</filter-name>
       <url-pattern>/profile/oidc/*</url-pattern>
     </filter-mapping>

But I'm not yet quite sure if this is the correct approach. And we need to list patterns
of RPs, which is not practical.

The example above is valid for Tomcat. For Jetty, a similar approach may work
using org.eclipse.jetty.servlets.CrossOriginFilter. See [1] for examples.


   Daniel



[1] https://wiki.shibboleth.net/confluence/display/KB/Cross-origin+AJAX+requests+for+Shib-protected+resources