I am tempted to let my OpenID Connect/Oauth2 OP to accept CORS request on an oauth2 endpoint after checking that client id and its allowed origin match.

This way a RP would be able to get a response directly without using redirect_uri or a postmessage relay or a web storage relay madness.

Any foreseen issues?

  • 2
    How would that work? I mean how would you protect the "secret"? – themihai Apr 26 '16 at 15:27
  • 1
    You have not provided enough information for anyone to give you an accurate answer. The only advice i can give you is to read the OAuth RFCs. – rook Dec 24 '16 at 20:13

If you are restricting the output of CORS headers for trusted client IDs and origin combinations only then this should not open up your site to any CSRF attack vectors.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.