Troubleshooting: OpenID Error - Blocked by CORS Policy, No 'Access-Control-Allow-Origin' Header

Version Affected: All
 
 

Overview

When configuring an OpenID Connect (OIDC) based Service Provider (SP) against a SecureAuth realm, the browser may block the SP's call to the realm with a Cross-Origin Resource Sharing (CORS) error similar to: Access to XMLHttpRequest at '<IdP well-known configuration URL>' from origin '<SP origin>' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
 
 

Cause

Modern browsers block a page's JavaScript from reading the response of a cross-origin request unless the server's response includes CORS headers explicitly allowing that origin. SecureAuth realms do not add these headers to their OpenID/OAuth endpoints by default, so the SP's own browser-side request fails this check even though the underlying request would otherwise succeed.
 
 

Resolution

Add CORS support to the realm using the IIS CORS module:

1. Install the IIS CORS module on the IdP server.
2. In the SecureAuth Web Admin console, open the OpenID/OAuth realm's System Info tab and click Decrypt.
3. Make a backup copy of the realm's web.config file.
4. Edit web.config to add the CORS headers needed for your SP's origin(s).

The recommended approach is to scope the CORS module to specific paths using a <location> element, rather than enabling it for the entire realm. Add the <location> block near the bottom of web.config, before the closing </configuration> tag. For example:

…
<location path="secureauth.aspx">
  <system.webServer>
    <cors enabled="true" failUnlistedOrigins="true">
      <add origin="https://mysp.example.com">
        … other settings as needed
      </add>
      <add origin="https://idp.example.com">
        … other settings as needed
      </add>
    </cors>
  </system.webServer>
</location>
</configuration>

See Microsoft's IIS CORS module configuration reference for the full list of settings available inside each <add origin="..."> block. You will need one <location> block for the realm's default SecureAuth.aspx endpoint, plus one for each additional OpenID/OAuth endpoint your integration uses.

Special Considerations

If you need these CORS settings applied to the whole realm instead of scoping them with <location> blocks, add them to the <system.webServer> section that already exists in web.config outside of any <location> tag. Do not add a second, separate <system.webServer> section of your own — IIS may silently discard it on the next save, since only one such section is honored outside of location tags.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.