<div dir="ltr">Just found my error. <div><br></div><div>I've misunderstood the parameter cors.allowed.headers. </div><div><br></div><div>After adding the header x-xsrf-token in the allowed CORS headers the preflight request is working fine now.</div><div><br></div><div>Best,</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Le ven. 24 févr. 2023 à 17:20, Armando Martins <<a href="mailto:armando.mart1s@gmail.com">armando.mart1s@gmail.com</a>> a écrit :<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi,<div><br></div><div>after capturing my preflight request with burp, i noticed tha if i remove one of the headers Access-Control-Request-Method or Access-Control-Request-Headers i don't get a 403 anymore.</div><div><br></div><div>Here is the original request :</div><div><br></div><div>OPTIONS /idp/profile/oidc/authorize?response_type=code&scope=openid%20profile&client_id=SP_OIDC&state=1XGHHV0FzPtHlWS-W2_f02OjYZ8&redirect_uri=https%3A%2F%<a href="http://2Fsp.exemple.net" target="_blank">2Fsp.exemple.net</a>%2Fredirect_uri&nonce=2Eq94_7UwIuHlJvLiQ-uMa-mSmjO2oH7Jm7jE1bC2-s HTTP/2<br>Host: <a href="http://idp.exemple.net" target="_blank">idp.exemple.net</a><br>User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0<br>Accept: */*<br>Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3<br>Accept-Encoding: gzip, deflate<br>Access-Control-Request-Method: GET<br>Access-Control-Request-Headers: x-xsrf-token<br>Referer: <a href="https://sp.exemple.net/" target="_blank">https://sp.exemple.net/</a><br>Origin: <a href="https://sp.exemple.net" target="_blank">https://sp.exemple.net</a><br>Sec-Fetch-Dest: empty<br>Sec-Fetch-Mode: cors<br>Sec-Fetch-Site: cross-site<br>Te: trailers<br></div><div><br></div><div>And the Response of this Preflight request is :</div><div><br></div><div>HTTP/2 403 Forbidden<br>Set-Cookie: JSESSIONID=C7855D0EDF2C4872ECF6BB75553B5FD9; Path=/idp; Secure; HttpOnly<br>Content-Type: text/plain;charset=UTF-8<br>Content-Length: 0<br>Date: Fri, 24 Feb 2023 16:11:15 GMT<br></div><div><br></div><div>But if i remove the Access-Control-Request-Headers from my original request i get this response :</div><div><br></div><div>HTTP/2 200 OK<br>Set-Cookie: JSESSIONID=D59167C7F37379274B87FB83377E09AC; Path=/idp; Secure; HttpOnly<br>Vary: origin,access-control-request-method,Access-Control-Request-Headers<br>Access-Control-Allow-Origin: <a href="https://sp.exemple.net" target="_blank">https://sp.exemple.net</a><br>Access-Control-Allow-Credentials: true<br>Access-Control-Max-Age: 1800<br>Access-Control-Allow-Methods: HEAD,POST,GET,OPTIONS<br>Access-Control-Allow-Headers: authorization,origin,x-requested-with,access-control-request-headers,content-type,access-control-request-method,accept<br>Content-Length: 0<br>Date: Fri, 24 Feb 2023 16:13:31 GMT<br></div><div><br></div><div>I also disabled the CSRF Protection by adding "idp.csrf.enabled = false" to my IDP and the result is the same.... So that's not the problem.</div><div><br></div><div>If someone, have an idea on what i'm missing, any help would be greatly appreciated.</div><div><br></div><div>Best,</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Le jeu. 23 févr. 2023 à 17:45, Armando Martins <<a href="mailto:armando.mart1s@gmail.com" target="_blank">armando.mart1s@gmail.com</a>> a écrit :<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi,<div><br></div><div>I'm trying to use the OIDC plugin with Shibboleth 4.2.1.</div><div><br></div><div>All is working fine except when the service provider try to renew the cookie after 10mn of inactivity.</div><div><br></div><div>In fact, after client inactivity the browser try to do a Cors Preflight request. But the request fails with a 403 status.</div><div><br></div><div><div>that seems related to the cross-site request forgery mitigation but i can't find out a good way to put an exception on the oidc profile endpoint.</div><div><br></div><div>Here is the Cors configuration that i put in my idp webapp web.xml :</div><div><br></div><div><!-- Cors Authorization --><br><filter><br> <filter-name>CorsFilter</filter-name><br> <filter-class>org.apache.catalina.filters.CorsFilter</filter-class><br> <init-param><br> <param-name>cors.allowed.origins</param-name><br> <param-value><br> <a href="https://sp.exemple.net/" target="_blank">https://sp.exemple.net</a><br> </param-value><br> </init-param><br> <init-param><br> <param-name>cors.allowed.methods</param-name><br> <param-value>GET,POST,HEAD,OPTIONS</param-value><br> </init-param><br> <init-param><br> <param-name>cors.allowed.headers</param-name><br> <param-value><br> Origin,<br> X-Requested-With,<br> Content-Type, Accept,<br> Access-Control-Request-Method,<br> Access-Control-Request-Headers,<br> Authorization<br> </param-value><br> </init-param><br> <init-param><br> <param-name>cors.support.credentials</param-name><br> <param-value>true</param-value><br> </init-param><br></filter><br><br><filter-mapping><br> <filter-name>CorsFilter</filter-name><br> <url-pattern>/profile/oidc/*</url-pattern><br></filter-mapping><br></div><div><br></div><div>Here is the configuration i'm using on the service provider :</div><div><br></div><div>Debian 11 with apache2.4.54 and mod-auth-openidc 2.4.9</div><div><br></div><div>And on my identity provider :</div><div><br></div><div>Debian 11 with tomcat9.0.43, shibboleth 4.2.1 with idp-plugin-oidc-op 3.0.0</div><div><br></div><div>Thanks in advance for your help.</div><div><br></div><div>Best,</div></div><div><br></div><div><br></div>-- <br><div dir="ltr">Armando Martins<br></div></div>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr">Armando Martins<br></div>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature">Armando Martins<br></div>