CORS issue on /oauth/token request

General
,
#1

I first send a non-logged in user to the Hosted Login page through auth0 which redirects them to http://mysite.com?code=123auth_123code. If a user is logged in, then I gather the authorization code and do the same redirect.

Once in my site, I attempt to gather the access token using the authorization code by asking https://mydomain.auth0.com/oauth/token. I then get the error “Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘http://mysite.com’ is therefore not allowed access.” I have added http://mysite.com to the client’s allowed callback URLs, allowed web origins, and allowed origins lists. The goal is to complete a implicit grant flow as described here https://auth0.com/docs/api-auth/tutorials/implicit-grant

I do not know what I am doing wrong. Is this because I am requesting the access code from an http domain instead of an https domain? Why is auth0 rejecting this cross domain call.

#2

Try upgrading to the latest version of whatever SDK you are using. That worked for me with the Lock widget.

#3

Since this is still in development, I was able to do this https://stackoverflow.com/questions/3102819/disable-same-origin-policy-in-chrome for testing and everything works as expected. I get my access_token. It seems the only problem is that the response from the /oauth/token endpoint does not contain the proper access-origin-allow header. Is there a setting somewhere in the auth0 dashboard that I missed? Does my audience name parameter in the /oauth/token request need to match the DNS name of the web app?

#4

Thanks for the advice. We made the change upgraded to the latest SDK but get the same error.

#5

Hey there!

Sorry for such huge delay in response! We’re doing our best in providing you with best developer support experience out there, but sometimes our bandwidth is not enough comparing to the number of incoming questions.

Wanted to reach out to know if you still require further assistance?

#6