Trouble with OIDC Cors Preflight Request

[Armando Martins]

Hi,

after capturing my preflight request with burp, i noticed tha if i remove
one of the headers Access-Control-Request-Method
or Access-Control-Request-Headers i don't get a 403 anymore.

Here is the original request :

OPTIONS
/idp/profile/oidc/authorize?response_type=code&scope=openid%20profile&client_id=SP_OIDC&state=1XGHHV0FzPtHlWS-W2_f02OjYZ8&redirect_uri=https%3A%2F%
2Fsp.exemple.net%2Fredirect_uri&nonce=2Eq94_7UwIuHlJvLiQ-uMa-mSmjO2oH7Jm7jE1bC2-s
HTTP/2
Host: idp.exemple.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
Firefox/102.0
Accept: */*
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-xsrf-token
Referer: https://sp.exemple.net/
Origin: https://sp.exemple.net
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Te: trailers

And the Response of this Preflight request is :

HTTP/2 403 Forbidden
Set-Cookie: JSESSIONID=C7855D0EDF2C4872ECF6BB75553B5FD9; Path=/idp; Secure;
HttpOnly
Content-Type: text/plain;charset=UTF-8
Content-Length: 0
Date: Fri, 24 Feb 2023 16:11:15 GMT

But if i remove the Access-Control-Request-Headers from my original request
i get this response :

HTTP/2 200 OK
Set-Cookie: JSESSIONID=D59167C7F37379274B87FB83377E09AC; Path=/idp; Secure;
HttpOnly
Vary: origin,access-control-request-method,Access-Control-Request-Headers
Access-Control-Allow-Origin: https://sp.exemple.net
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 1800
Access-Control-Allow-Methods: HEAD,POST,GET,OPTIONS
Access-Control-Allow-Headers:
authorization,origin,x-requested-with,access-control-request-headers,content-type,access-control-request-method,accept
Content-Length: 0
Date: Fri, 24 Feb 2023 16:13:31 GMT

I also disabled the CSRF Protection by adding "idp.csrf.enabled = false" to
my IDP and the result is the same.... So that's not the problem.

If someone, have an idea on what i'm missing, any help would be greatly
appreciated.

Best,

Le jeu. 23 févr. 2023 à 17:45, Armando Martins <armando.mart1s at gmail.com> a
écrit :

> Hi,
>
> I'm trying to use the OIDC plugin with Shibboleth 4.2.1.
>
> All is working fine except when the service provider try to renew the
> cookie after 10mn of inactivity.
>
> In fact, after client inactivity the browser try to do a Cors Preflight
> request. But the request fails with  a 403 status.
>
> that seems related to the cross-site request forgery mitigation but i
> can't find out a good way to put an exception on the oidc profile endpoint.
>
> Here is the Cors configuration that i put in my idp webapp web.xml :
>
> <!-- Cors Authorization -->
> <filter>
>   <filter-name>CorsFilter</filter-name>
>   <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
>   <init-param>
>     <param-name>cors.allowed.origins</param-name>
>     <param-value>
>         https://sp.exemple.net
>     </param-value>
>   </init-param>
>   <init-param>
>     <param-name>cors.allowed.methods</param-name>
>     <param-value>GET,POST,HEAD,OPTIONS</param-value>
>   </init-param>
>   <init-param>
>     <param-name>cors.allowed.headers</param-name>
>     <param-value>
>         Origin,
>         X-Requested-With,
>         Content-Type, Accept,
>         Access-Control-Request-Method,
>         Access-Control-Request-Headers,
>         Authorization
>     </param-value>
>   </init-param>
>   <init-param>
>     <param-name>cors.support.credentials</param-name>
>     <param-value>true</param-value>
>   </init-param>
> </filter>
>
> <filter-mapping>
>   <filter-name>CorsFilter</filter-name>
>   <url-pattern>/profile/oidc/*</url-pattern>
> </filter-mapping>
>
> Here is the configuration i'm using on the service provider :
>
> Debian 11 with apache2.4.54 and mod-auth-openidc 2.4.9
>
> And on my identity provider :
>
> Debian 11 with tomcat9.0.43, shibboleth 4.2.1 with idp-plugin-oidc-op 3.0.0
>
> Thanks in advance for your help.
>
> Best,
>
>
> --
> Armando Martins
>


-- 
Armando Martins
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230224/cb23cd86/attachment.htm>