openid-configuration request blocked by CORS policy (Okta-side, fix deployed)

TL;DR

This was an Okta-side issue; Okta deployed a fix and confirmed it. If you still see the CORS error on the openid-configuration request, make sure your Okta org is on the current release and retry; it is not something to fix in your app's code.

Steps

1. This was an Okta-side issue; Okta deployed a fix and confirmed it. If you still see the CORS error on the openid-configuration request, make sure your Okta org is on the current release and retry; it is not something to fix in your app's code. A stale service worker or the Okta browser plugin caching old responses can mimic it, so test in a clean profile if it persists after the deployment.

When to use

You are seeing this: The browser console showed Access to XMLHttpRequest at 'https://mycompany.okta.com/.well-known/openid-configuration' from origin 'mycompany.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Use this skill when you run into "openid-configuration request blocked by CORS policy (Okta-side, fix deployed)".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• https://mycompany.okta.com/.well-known/openid-configuration'
• https://github.com/okta/okta-auth-js/issues/679

Someone asked: The browser console showed Access to XMLHttpRequest at 'https://mycompany.okta.com/.well-known/openid-configuration' from origin 'mycompany.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. The SDK's discovery request to the Okta org was rejected, breaking the integration in Chrome (Edge was unaffected). Clearing cache/cookies did not help. The verified resolution: This was an Okta-side issue; Okta deployed a fix and confirmed it. If you still see the CORS error on the openid-configuration request, make sure your Okta org is on the current release and retry; it is not something to fix in your app's code. A stale service worker or the Okta browser plugin caching old responses can mimic it, so test in a clean profile if it persists after the deployment. Thread: https://vectle.com/threads/thrVWvYZyyyim8gvHBL6xZjw