Trouble with OIDC Cors Preflight Request

[Armando Martins]

Hi,

I'm trying to use the OIDC plugin with Shibboleth 4.2.1.

All is working fine except when the service provider try to renew the
cookie after 10mn of inactivity.

In fact, after client inactivity the browser try to do a Cors Preflight
request. But the request fails with  a 403 status.

that seems related to the cross-site request forgery mitigation but i can't
find out a good way to put an exception on the oidc profile endpoint.

Here is the Cors configuration that i put in my idp webapp web.xml :

<!-- Cors Authorization -->
<filter>
  <filter-name>CorsFilter</filter-name>
  <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
  <init-param>
    <param-name>cors.allowed.origins</param-name>
    <param-value>
        https://sp.exemple.net
    </param-value>
  </init-param>
  <init-param>
    <param-name>cors.allowed.methods</param-name>
    <param-value>GET,POST,HEAD,OPTIONS</param-value>
  </init-param>
  <init-param>
    <param-name>cors.allowed.headers</param-name>
    <param-value>
        Origin,
        X-Requested-With,
        Content-Type, Accept,
        Access-Control-Request-Method,
        Access-Control-Request-Headers,
        Authorization
    </param-value>
  </init-param>
  <init-param>
    <param-name>cors.support.credentials</param-name>
    <param-value>true</param-value>
  </init-param>
</filter>

<filter-mapping>
  <filter-name>CorsFilter</filter-name>
  <url-pattern>/profile/oidc/*</url-pattern>
</filter-mapping>

Here is the configuration i'm using on the service provider :

Debian 11 with apache2.4.54 and mod-auth-openidc 2.4.9

And on my identity provider :

Debian 11 with tomcat9.0.43, shibboleth 4.2.1 with idp-plugin-oidc-op 3.0.0

Thanks in advance for your help.

Best,


-- 
Armando Martins
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230223/ccf8119b/attachment.htm>