{"action":"created","issue":{"url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1109","repository_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server","labels_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1109/labels{/name}","comments_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1109/comments","events_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1109/events","html_url":"https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1109","id":170619835,"number":1109,"title":"It's impossible to use CORS for '/token', and other protected resources.","user":{"login":"xeagle2","id":794189,"avatar_url":"https://avatars.githubusercontent.com/u/794189?v=3","gravatar_id":"","url":"https://api.github.com/users/xeagle2","html_url":"https://github.com/xeagle2","followers_url":"https://api.github.com/users/xeagle2/followers","following_url":"https://api.github.com/users/xeagle2/following{/other_user}","gists_url":"https://api.github.com/users/xeagle2/gists{/gist_id}","starred_url":"https://api.github.com/users/xeagle2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xeagle2/subscriptions","organizations_url":"https://api.github.com/users/xeagle2/orgs","repos_url":"https://api.github.com/users/xeagle2/repos","events_url":"https://api.github.com/users/xeagle2/events{/privacy}","received_events_url":"https://api.github.com/users/xeagle2/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-08-11T11:02:12Z","updated_at":"2016-08-11T11:47:50Z","closed_at":"2016-08-11T11:47:50Z","body":"In case of using CORS https://en.wikipedia.org/wiki/Cross-origin_resource_sharing, browsers make http method = 'OPTIONS' request to server and negotiate the allowance of making the cross origin request. \r\n\r\nSo, request fails with BadCredentialsException(\"No client credentials presented\");\r\n\r\nBut it shouldn't fail in this case.\r\n\r\nThere is a configuration: \r\n```\r\n<security:http pattern=\"/token\"\r\n\t\tcreate-session=\"stateless\"\r\n\t\tauthentication-manager-ref=\"clientAuthenticationManager\"\r\n\t\tentry-point-ref=\"oauthAuthenticationEntryPoint\"\r\n\t\tuse-expressions=\"true\">\r\n\r\n\t\t<security:intercept-url pattern=\"/token\" access=\"permitAll\" method=\"OPTIONS\" /> <!-- allow OPTIONS calls without auth for CORS stuff -->\r\n\t\t<security:intercept-url pattern=\"/token\" access=\"isAuthenticated()\" />\r\n\t\t<security:http-basic entry-point-ref=\"oauthAuthenticationEntryPoint\" />\r\n\t\t<!-- include this only if you need to authenticate clients via request parameters -->\r\n\t\t<security:custom-filter ref=\"clientAssertionEndpointFilter\" after=\"PRE_AUTH_FILTER\" /> <!-- this one has to go first -->\r\n\t\t<security:custom-filter ref=\"clientCredentialsEndpointFilter\" after=\"BASIC_AUTH_FILTER\" />\r\n\t\t<security:custom-filter ref=\"corsFilter\" after=\"SECURITY_CONTEXT_FILTER\" />\r\n\t\t<security:access-denied-handler ref=\"oauthAccessDeniedHandler\" />\r\n\t</security:http>\r\n\r\n```\r\n**access=\"permitAll\"** doesn't solve everything, because there is one more custom filter '**clientCredentialsEndpointFilter**' which uses '**clientAuthMatcher**' bean to determine if request should be authenticated or not.\r\n\r\nSo, the 'clientCredentialsEndpointFilter' is executed and is unable to find the parameter 'client_id' and 'client_secret' which are specific for POST request, not for the OPTIONS, hence it fails.\r\n\r\nI would be thankful if you can fix it.\r\n\r\nThank you,"},"comment":{"url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/comments/239139027","html_url":"https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1109#issuecomment-239139027","issue_url":"https://api.github.com/repos/mitreid-connect/OpenID-Connect-Java-Spring-Server/issues/1109","id":239139027,"user":{"login":"jricher","id":122511,"avatar_url":"https://avatars.githubusercontent.com/u/122511?v=3","gravatar_id":"","url":"https://api.github.com/users/jricher","html_url":"https://github.com/jricher","followers_url":"https://api.github.com/users/jricher/followers","following_url":"https://api.github.com/users/jricher/following{/other_user}","gists_url":"https://api.github.com/users/jricher/gists{/gist_id}","starred_url":"https://api.github.com/users/jricher/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jricher/subscriptions","organizations_url":"https://api.github.com/users/jricher/orgs","repos_url":"https://api.github.com/users/jricher/repos","events_url":"https://api.github.com/users/jricher/events{/privacy}","received_events_url":"https://api.github.com/users/jricher/received_events","type":"User","site_admin":false},"created_at":"2016-08-11T11:47:50Z","updated_at":"2016-08-11T11:47:50Z","body":"Correct, CORS is not supported on the token endpoint."}}
{"actor":{"display_login":"jricher"}}