Allow configuring of CORS allow origin headers

Question

Allow configuring of CORS allow origin headers

indy-independence opened this issue 8 months ago · 1 comments

indy-independence commented 8 months ago

Code Version

running satosa in docker, with SATOSA oidcop frontend

Expected Behavior

Have a way to configure CORS allowed origins, for example in keycloak they seem to call it "Web Origins" and it's configured per client

Current Behavior

When making requests to for example openid-configuration or userinfo endpoint from a react SPA, requests are blocked because there is no Access-Control-Allow-Origin headers in the response, and I can't find a way to configure this in satosa

Possible Solution

New configurations and/or documentation?

Steps to Reproduce

Answer 1 · 2024-02-19T13:36:19.000Z

Right now this functionality is offloaded to the frontend web-server that you are probably already using (ie, nginx). There you can define properly what headers should be returned for a specific request.

I do not reject implementing this but it is definitely not a priority, and it brings in the question "how many other things that a web-server does should be part of the configuration of this app?".