Fix: CORS issues in third-party auth disconnect by adding JSON endpoint

common/djangoapps/third_party_auth/custom_disconnect_view.py

@@ -0,0 +1,104 @@
+"""
+Custom disconnect view that returns JSON instead of redirecting to avoid CORS issues.
+"""
+from django.http import JsonResponse
+from django.contrib.auth.decorators import login_required
+from django.views.decorators.http import require_http_methods
+from django.core.exceptions import ValidationError, PermissionDenied
+from django.db import DatabaseError
+from social_django.utils import psa
+from social_django.models import UserSocialAuth
+
+
+@login_required
+@require_http_methods(["POST"])
+@psa()
+def disconnect_json_view(request, backend, association_id=None):
+    """
+    Custom disconnect view that returns JSON response instead of redirecting.
+    This prevents CORS issues when called from MFE frontends.
+    """
+    user = request.user
+
+    # Check URL parameter first, then POST parameter, and fallback to GET parameter for backward compatibility
+    if not association_id:
+        association_id = request.POST.get('association_id') or request.GET.get('association_id')
+
+    try:
+        if association_id:
+            # Disconnect specific association by ID
+            association = UserSocialAuth.objects.get(
+                id=association_id,
+                user=user,
+                provider=backend
+            )
+            association.delete()
+        else:
+            # Disconnect all associations for this backend
+            UserSocialAuth.objects.filter(
+                user=user,
+                provider=backend
+            ).delete()
+
+        return JsonResponse({
+            'success': True,
+            'message': 'Account successfully disconnected',
+            'backend': backend,
+            'association_id': association_id
+        })
+
+    except UserSocialAuth.DoesNotExist:
+        return JsonResponse({
+            'success': False,
+            'error': 'Social auth association not found',
+            'backend': backend,
+            'association_id': association_id
+        }, status=404)
+
+    except ValueError as e:
+        return JsonResponse({
+            'success': False,
+            'error': 'Invalid parameter value provided',
+            'backend': backend,
+            'association_id': association_id
+        }, status=400)
+
+    except TypeError as e:
+        return JsonResponse({
+            'success': False,
+            'error': 'Invalid parameter type provided',
+            'backend': backend,
+            'association_id': association_id
+        }, status=400)
+
+    except DatabaseError as e:
+        return JsonResponse({
+            'success': False,
+            'error': 'Database operation failed',
+            'backend': backend,
+            'association_id': association_id
+        }, status=500)
+
+    except ValidationError as e:
+        return JsonResponse({
+            'success': False,
+            'error': 'Validation failed',
+            'backend': backend,
+            'association_id': association_id
+        }, status=400)
+
+    except PermissionDenied as e:
+        return JsonResponse({
+            'success': False,
+            'error': 'Permission denied',
+            'backend': backend,
+            'association_id': association_id
+        }, status=403)
+
+    except Exception as e:
+        return JsonResponse({
+            'success': False,
+            'error': 'An unexpected error occurred',
+            'backend': backend,
+            'association_id': association_id
+        }, status=500)

common/djangoapps/third_party_auth/pipeline.py

@@ -379,10 +379,11 @@ def get_disconnect_url(provider_id, association_id):
         ValueError: if no provider is enabled with the given ID.
     """
     backend_name = _get_enabled_provider(provider_id).backend_name
+    # Use custom JSON disconnect endpoint to avoid CORS issues
     if association_id:
-        return _get_url('social:disconnect_individual', backend_name, url_params={'association_id': association_id})
+        return _get_url('custom_disconnect_json_individual', backend_name, url_params={'association_id': association_id})
     else:
-        return _get_url('social:disconnect', backend_name)
+        return _get_url('custom_disconnect_json', backend_name)
 
 
 def get_login_url(provider_id, auth_entry, redirect_url=None):

common/djangoapps/third_party_auth/urls.py

@@ -10,13 +10,17 @@
     post_to_custom_auth_form,
     saml_metadata_view
 )
+from .custom_disconnect_view import disconnect_json_view
 
 urlpatterns = [
     path('auth/inactive', inactive_user_view, name="third_party_inactive_redirect"),
     path('auth/custom_auth_entry', post_to_custom_auth_form, name='tpa_post_to_custom_auth_form'),
     re_path(r'^auth/saml/metadata.xml', saml_metadata_view),
     re_path(r'^auth/login/(?P<backend>lti)/$', lti_login_and_complete_view),
     path('auth/idp_redirect/<slug:provider_slug>', IdPRedirectView.as_view(), name="idp_redirect"),
+    # Custom JSON disconnect endpoint to avoid CORS issues
+    re_path(r'^auth/disconnect_json/(?P<backend>[^/]+)/$', disconnect_json_view, name='custom_disconnect_json'),
+    re_path(r'^auth/disconnect_json/(?P<backend>[^/]+)/(?P<association_id>\d+)/$', disconnect_json_view, name='custom_disconnect_json_individual'),
     path('auth/', include('social_django.urls', namespace='social')),
     path('auth/saml/v0/', include('common.djangoapps.third_party_auth.samlproviderconfig.urls')),
     path('auth/saml/v0/', include('common.djangoapps.third_party_auth.samlproviderdata.urls')),