oidc userinfo endpoint blocking OPTIONS requests

[Cantor, Scott]

On 2/3/21, 2:33 AM, "users on behalf of Daniel Lutz" <users-bounces at shibboleth.net on behalf of daniel.lutz at switch.ch> wrote:

>    We hit this issue too recently. I found that the 403 is probably produced by the Spring Framework.
>    Adding this filter to web.xml seemed to resolve the issue:

That's because there's nothing in the IdP that knows about them or what to do with them.

I think my question is: is there some reason the IdP *should*? I know nothing about CORS other than it's something I don't think should ever have been created but if it's a requirement for the broken web that exists today, it's unclear to me if it's the web server's job to deal with it or if it's an application issue.

>    But I'm not yet quite sure if this is the correct approach. And we need to list patterns
>    of RPs, which is not practical.

That's the part that maybe suggests this is something the IdP should be taught to handle in at least some cases but it's well beyond me.

-- Scott