fix(idp): allow CORS for all clients on token endpoint #11
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Simplify clientBasedCORS to return true for all clients, not just public clients with tokenEndpointAuthMethod 'none'. This fixes OIDC login for web apps loaded from CDN (like Mashlib from unpkg.com) where the origin doesn't match the client's redirect URIs. Solid servers are public and should accept token requests from any web app origin. Fixes #10
Solid-OIDC requires DPoP (Demonstrating Proof-of-Possession) tokens which use a DPoP HTTP header. Without this header in the CORS allowed headers list, browsers block the token exchange request.
oidc-provider v9+ always includes the iss parameter (RFC 9207) in authorization responses. Mashlib's solid-ui auth library doesn't handle this parameter, causing the OAuth callback to fail. This intercepts the Location header and strips the iss parameter before sending the redirect to the client.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
clientBasedCORSto returntruefor all clientsProblem
When Mashlib is loaded from CDN, the OIDC token exchange fails with:
The previous code only allowed CORS for clients with
tokenEndpointAuthMethod === 'none', but dynamically registered clients default toclient_secret_basic.Solution
Solid servers are public and should accept token requests from any web app origin, so
clientBasedCORSnow returnstruefor all clients.Test plan
Fixes #10