ASP Core Identity Server 4 Difference between Client Cors and start up Configuration Cors

user_9972222 0
Viewed 345

For Identity Server 4, I would like to know the difference between adding a Client specific CORS new client() {client.AllowedCorsOrigins = new List<string>() { "http://localhost:4222" };} and Adding the set up in Startup.cs Configure

 services.AddCors(options =>
            {
                // this defines a CORS policy called "default"
                options.AddPolicy("default", policy =>
                {
                    policy.WithOrigins("Origin")
                        .AllowAnyHeader()
                        .AllowAnyMethod();
                });
            });

For context I've recently been learning about the methods ReactJS SPA needs to use when accessing Single Sign-on through another party, and as it stands I have implemented the Library 'oidc-client-js' and use the Authorisation code flow with PKCE because that it the standard implementation, and everything works. But I need help in understanding something:

  1. If I remove the Cors options in StartUp the authorisation will fail and return a origin has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource, why is the client Cors setting not enough? (is it maybe used further down the line with an API call?)

Any information you know of would really help, thanks.

identityserver4 authorization
1 Answers

IdentityServer is implemented as a middleware, same the ASP.NET Core CORS middlware.

You need to add CORS to the IdentityServer module because you want for example be able to restrict your CORS settings per IdentityServer client.

The ASP.NET Core CORS module will handle everything that IdentityServer does not catch, like request for REST API's that you have implemented your self.

enter image description here

Hope this helps. So, define CORS in IdentityServer for request to the API's that IdentityServer provides (like UserInfo endpoint) and the other CORS settings for your own API's.

Andy_684900
Related