hydra: Client allowed_cors_origins not working

Nice find, it actually appears that the server-based origin only works if the server config is either

serve:
  public:
    cors:
      enabled: true
      allowed_origins: 
        - *
        # - you may include additional origins here but since there's already a wildcard it doesn't make sense

or

serve:
  public:
    cors:
      enabled: true

but not if a concrete value is set. That’s definitely a bug!

Instead of doing a check here

https://github.com/ory/hydra/blob/master/driver/cors.go#L60-L70

we should merge these origins with values coming the client and then run the glob matching on top of that.

We can still keep the alwaysAllow check to reduce request latency in cases where all origins are allowed.

Ok at last I found the solution!

In order to pass the client_id in basic-auth when token_endpoint_auth_method = none, you need to leave the colon after the client_id.

For example:

  xhr.setRequestHeader(
    "Authorization",
    "Basic " + btoa(clientId + ":")
  );

If you include a dummy password or omit the colon, it will not work.

Thank you very much @IronGeek !

Unfortunately, this still isn’t working as I would expect. (tested with version 1.5.2) Configuring allowed_cors_origins on the oauth client effectively does nothing, whatever I configure in serve.public.cors.allowed_origins is the only thing that’s honored.

If I set serve.public.cors.enabled=false or just don’t set it, then I get no access-control headers returned at all regardless of what I set in the client for allowed_cors_origins.

If I set serve.public.cors.allowed_origins to “" that works, but only because it’s returning the Access-Control-Allow-Origin header of "” which effectively makes client configured cors obsolete.