Pinniped server CORS headers missing

[exolicious]

What happened?

I want to configure pinniped-oidc for a webapp according to this guide: https://pinniped.dev/docs/howto/configure-auth-for-webapps/

It says: "Clients must use PKCE during the authorization code flow."
However the supervisor does not seem to set CORS related Headers.
Setting them on an httpproxy (contour) is also not an option, since tlspassthrough is recomended.

What did you expect to happen?

I expect the CORS headers to be set on the response, since the guide's title is "Using the Pinniped Supervisor to provide authentication for web applications" and it says "Clients must use PKCE during the authorization code flow."

What is the simplest way to reproduce this behavior?

Connect any SPA as an oidcclient in pinniped supervisor and try to access the wellknown endpoint through a js-fetch.

In what environment did you see this bug?

• Pinniped server version: pinniped-server:v0.35.0
• Pinniped client version: N/A
• Pinniped container image (if using a public container image): ghcr.io/vmware-tanzu/pinniped/pinniped-server:v0.35.0@sha256:bf926dfd78ecca75fce0e43e243021dd9c122bd2cd94d38187b3c9f80138fca4
  (other stuff is not relevant)

What else is there to know about this bug?

[cfryanr]

Hi @exolicious, thanks for creating this issue. As you noticed, currently the Supervisor doesn't support single page apps (SPAs). Sorry if the doc did not make that clear. It currently assumes that your webapp has a backend, and that the backend is what will redeem the authcodes at the token endpoint. It still requires PKCE for these apps as well, because it is considered the current best practice for OAuth2.

We could take a look at what would be required to also support SPAs.

[exolicious]

@cfryanr Thank you very much for answering so quickly.
I did not know that PKCE was the best practice for any client, but apparently it still is recommended for confidential clients. Thank you for this information.

We would really appreciate if pinniped supported SPAs, since we would like to have a fully state/sessionless backend if possible.

[exolicious]

@cfryanr I looked at the code and this is a quick solution:
At this position in the code (

pinniped/internal/federationdomain/endpointsmanager/manager.go

Line 196 in e86f3cc

}

), you could add generic cors headers to every response (the allow origin should probably come from a config value and not be "*" - maybe you could even introduce the option of adding arbitrary headers through a configmap or something).

For example:
resp.Header().Set("Access-Control-Allow-Origin", "*")
resp.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
resp.Headers().Set("Access-Control-Allow-Headers", "Authorization, Content-Type")
resp.Headers().Set("Access-Control-Allow-Credentials", "true")
resp.Headers().Set("Access-Control-Max-Age", "3600")

I can create a PR for a more sophisticated solution tomorrow, if you want.