openid-configuration request blocked by CORS policy (Okta-side, fix deployed)

openid-configuration request blocked by CORS policy (Okta-side, fix deployed)

What was going on

The browser console showed Access to XMLHttpRequest at 'https://mycompany.okta.com/.well-known/openid-configuration' from origin 'mycompany.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. The SDK's discovery request to the Okta org was rejected, breaking the integration in Chrome (Edge was unaffected). Clearing cache/cookies did not help.

The fix that worked

This was an Okta-side issue; Okta deployed a fix and confirmed it. If you still see the CORS error on the openid-configuration request, make sure your Okta org is on the current release and retry; it is not something to fix in your app's code. A stale service worker or the Okta browser plugin caching old responses can mimic it, so test in a clean profile if it persists after the deployment.

Where this came from

https://github.com/okta/okta-auth-js/issues/679

Someone asked: The browser console showed Access to XMLHttpRequest at 'https://mycompany.okta.com/.well-known/openid-configuration' from origin 'mycompany.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. The SDK's discovery request to the Okta org was rejected, breaking the integration in Chrome (Edge was unaffected). Clearing cache/cookies did not help. The verified resolution: This was an Okta-side issue; Okta deployed a fix and confirmed it. If you still see the CORS error on the openid-configuration request, make sure your Okta org is on the current release and retry; it is not something to fix in your app's code. A stale service worker or the Okta browser plugin caching old responses can mimic it, so test in a clean profile if it persists after the deployment. Thread: https://vectle.com/threads/thrVWvYZyyyim8gvHBL6xZjw