mirror of
https://github.com/pocket-id/pocket-id.git
synced 2025-12-11 07:42:58 +03:00
🐛 Bug Report: CORS issue when using PKCE Code Challenge with SPA #450
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @cdemi on GitHub.
Reproduction steps
You can test it using https://oidcdebugger.com/ Authorization Code Flow with PKCE
Expected behavior
To be honest, no idea what the expected behaviour should be. Maybe the callback domains could be added to the CORS list?
Actual Behavior
Access to XMLHttpRequest at 'https://mypocketiddomain/api/oidc/token' from origin 'https://oidcdebugger.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
@cdemi commented on GitHub:
Actually, looks like the CORS issue does not only affect the
/api/oidc/tokenendpoint but also the/.well-known/openid-configuration.For example, in Grafana, when you try to setup Generic OAuth, you can give it the OpenID Connect Discovery URL and the browser fetches it to auto populate the fields, but due to CORS: `Access to fetch at 'https://mypocketiddomain/.well-known/openid-configuration' from origin 'https://mygrafanadomain' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
@stonith404 commented on GitHub:
PKCE is actually not implemented yet. I've created a feature request #65.
I'll close this issue but feel free to subscribe to #65 to get a notification when this gets implemented.