oidc userinfo endpoint blocking OPTIONS requests

[Daniel Lutz]

Cantor, Scott schrieb/wrote (03.02.21 14:58):
> On 2/3/21, 2:33 AM, "users on behalf of Daniel Lutz" <users-bounces at shibboleth.net on behalf of daniel.lutz at switch.ch> wrote:
> 
>>     We hit this issue too recently. I found that the 403 is probably produced by the Spring Framework.
>>     Adding this filter to web.xml seemed to resolve the issue:
> 
> That's because there's nothing in the IdP that knows about them or what to do with them.
> 
> I think my question is: is there some reason the IdP *should*? I know nothing about CORS other than it's something I don't think
> should ever have been created but if it's a requirement for the broken web that exists today, it's unclear to me if it's the web
> server's job to deal with it or if it's an application issue.

I think there is a reason the IdP should support CORS for the OIDC UserInfo endpoint:

The "OpenID Connect Core 1.0" specification says in "5.3. UserInfo Endpoint" [1]:

   "The UserInfo Endpoint SHOULD support the use of Cross Origin Resource Sharing (CORS) [CORS]
   and or other methods as appropriate to enable Java Script Clients to access the endpoint."


Daniel



[1] https://openid.net/specs/openid-connect-core-1_0.html#UserInfo