CORS issue when calling /oauth/device/code in device-flow

Get Help
6

This error is due to the fact that the /oauth/device/code endpoint does not handle CORS pre-flight (OPTION) requests, unlike the /oauth/token endpoint. I am not sure why this limitation is in place though…

OPTIONS /oauth/device/code HTTP/1.1
Host: my-tenant.eu.auth0.com
Origin: https://example.com
Access-Control-Request-Method: POST
Accept: */*

HTTP/1.1 404 Not Found

This prevents browsers from making any calls to that endpoint…

Note, that the WEB ORIGINS option is taken into account when there is an Origin header as performing a POST request with an invalid origin yields:

HTTP/1.1 403 Forbidden
...

{
	"error": "access_denied",
	"error_description": "Origin https://example.com is not allowed. Behavior used for check: WEB ORIGINS"
}
1 Like