How to configure CORS on client level?

[SimonVHB]

Hello everyone,

We're succesfully using OAuth/OIDC now on a front-end application but I'm still a bit confused on how to configure CORS correctly on client level.
On the CORS docs page, I read that specifying an URL in the client at allowed_cors_origins should work even though it is not listed under allowed_origins in the main configuration file.
Altough I am doing that, CORS only seem to work when I specifically include the URL in the main config.
I added my configs below, am I missing something?

The configuration (we're running Hydra v1.8.5):

For example here I try to enable cors for https://example.vercel.app.

Client

{
  "client_id": "example-client",
  "client_name": "Example client",
  "redirect_uris": [
    "https://example.vercel.app"
  ],
  "grant_types": [
    "authorization_code",
    "refresh_token"
  ],
  "response_types": [
    "token",
    "code",
    "id_token"
  ],
  "scope": "openid offline",
  "audience": [],
  "owner": "",
  "policy_uri": "",
  "allowed_cors_origins": [
    "https://example.vercel.app"
  ],
  "tos_uri": "",
  "client_uri": "",
  "logo_uri": "",
  "contacts": [],
  "client_secret_expires_at": 0,
  "subject_type": "public",
  "jwks": {},
  "token_endpoint_auth_method": "none",
  "userinfo_signed_response_alg": "none",
  "created_at": "2020-11-04T13:39:49Z",
  "updated_at": "2020-11-26T13:59:20Z",
  "metadata": {}
}

Main config (CORS not working)

serve:
  admin:
    cors:
     enabled: true
     allowed_origins:
        - https://other-url.vercel.app
      allowed_methods:
        - GET
        - PATCH
        - POST
        - PUT
        - DELETE
      allowed_headers:
        - Access-Control-Allow-Origin
        - X-Requested-With
        - Authorization
        - Content-Type
        - Origin
        - Authorization
        - Content-Type
      exposed_headers:
        - Origin
        - Content-Type
        - Access-Control-Allow-Origin
      allow_credentials: true
      options_passthrough: false
      max_age: 80959111
      debug: true
  public:
    cors:
      enabled: true
      allowed_origins:
        - https://other-url.vercel.app
      allowed_methods:
        - GET
        - PATCH
        - POST
        - PUT
        - DELETE
      allowed_headers:
        - Access-Control-Allow-Origin
        - X-Requested-With
        - Authorization
        - Content-Type
        - Origin
        - Authorization
        - Content-Type
      exposed_headers:
        - Origin
        - Content-Type
        - Access-Control-Allow-Origin
      allow_credentials: true
      options_passthrough: false
      max_age: 80959111
      debug: true

Now when I add https://example.vercel.app to allowed_origins it does work, but it should work just when specified in the client.
Main config (CORS working)

serve:
  admin:
    cors:
     enabled: true
     allowed_origins:
        - https://other-url.vercel.app
        - https://example.vercel.app
      allowed_methods:
        - GET
        - PATCH
        - POST
        - PUT
        - DELETE
      allowed_headers:
        - Access-Control-Allow-Origin
        - X-Requested-With
        - Authorization
        - Content-Type
        - Origin
        - Authorization
        - Content-Type
      exposed_headers:
        - Origin
        - Content-Type
        - Access-Control-Allow-Origin
      allow_credentials: true
      options_passthrough: false
      max_age: 80959111
      debug: true
  public:
    cors:
      enabled: true
      allowed_origins:
        - https://other-url.vercel.app
        - https://example.vercel.app
      allowed_methods:
        - GET
        - PATCH
        - POST
        - PUT
        - DELETE
      allowed_headers:
        - Access-Control-Allow-Origin
        - X-Requested-With
        - Authorization
        - Content-Type
        - Origin
        - Authorization
        - Content-Type
      exposed_headers:
        - Origin
        - Content-Type
        - Access-Control-Allow-Origin
      allow_credentials: true
      options_passthrough: false
      max_age: 80959111
      debug: true

[k9ert]

That's strange. Would love to reproduce it but that's a bit difficult and takes a bit more time. Sorry, i can't rule out for now that there's an issue in your configuration (or hydra-code).
Can you maybe make a screenshot of the developer-tools request/response or get the example-app to work?
I get:

➜  hydra git:(master) curl -I https://example.vercel.app                              
HTTP/2 404 
...

[SimonVHB]

https://example.vercel.app was just an example ;-)
This is a working example, which is allowed in the client but not in the general config: https://wg-fe-broker-platform-pjihn1txz.vercel.app
The login pages loads, but it's only after logging in that the problems occur and just redirects to the login screen.

I do see the following call failing to our hydra server:

Headers of the /oauth2/token call:

And in the logs of hydra I can find the following CORS logs:

[cors] 2020/12/18 13:18:56 Handler: Actual request
[cors] 2020/12/18 13:18:56   Actual request no headers added: origin 'https://wg-fe-broker-platform-pjihn1txz.vercel.app' not allowed

[vinckr]

Hey @SimonVHB, is this related to this issue possibly: #1754 ?

[SimonVHB]

Hey @vinckr, yes it looks like it. Thanks!