title: Nginx ingress with oauth proxy and CORS
body: <p>I have two services in Kubernetes which are exposed through nginx controller. Service <code>a</code> wants to invoke content on domain <code>b</code> but at the same time both services need to be authenticated through Google using the oauth-proxy service.</p>
  <p>So I have managed to enable CORS and <code>a</code> can invoke <code>b</code> without any issues. But the problem is when I include the authentication as well, I am constantly getting:</p>
  <pre><code>Access to manifest at 'https://accounts.google.com/o/oauth2/auth?access_type=offline&amp;approval_prompt=force&amp;client_id=&lt;obscured&gt;.apps.googleusercontent.com&amp;redirect_uri=https%3A%2F%2Fa.example.com%2Foauth2%2Fcallback&amp;response_type=code&amp;scope=profile+email&amp;state=&lt;obscured&gt;manifest.json' (redirected from 'https://a.example.com/manifest.json') from origin 'https://a.example.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
  </code></pre>
  <p>Here are the ingresses:</p>
  <p><strong>Service a</strong></p>
  <pre><code>apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      kubernetes.io/ingress.class: nginx
      kubernetes.io/tls-acme: &quot;true&quot;
      nginx.ingress.kubernetes.io/auth-url: &quot;https://$host/oauth2/auth&quot;
      nginx.ingress.kubernetes.io/auth-signin: &quot;https://$host/oauth2/start?rd=$escaped_request_uri&quot;
      nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
    name: a
  spec:
    rules:
    - host: a.example.com
      http:
        paths:
        - backend:
            service:
              name: a-svc
              port:
                number: 8080
          path: /
          pathType: Prefix
    tls:
    - hosts:
      - a.example.com
      secretName: a-tls
  
  ---
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
    labels:
      k8s-app: oauth2-proxy
    name: a-oauth
  spec:
    rules:
    - host: a.example.com
      http:
        paths:
        - backend:
            service:
              name: oauth2-proxy
              port:
                number: 4180
          path: /oauth2
          pathType: Prefix
    tls:
    - hosts:
        - a.example.com
      secretName: a-oauth-tls
  
  </code></pre>
  <p><strong>Service b</strong></p>
  <pre><code>apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      kubernetes.io/ingress.class: nginx
      kubernetes.io/tls-acme: &quot;true&quot;
      nginx.ingress.kubernetes.io/auth-url: &quot;https://$host/oauth2/auth&quot;
      nginx.ingress.kubernetes.io/auth-signin: &quot;https://$host/oauth2/start?rd=$escaped_request_uri&quot;
      nginx.ingress.kubernetes.io/enable-cors: &quot;true&quot;
      nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
    name: b
  spec:
    rules:
    - host: b.example.com
      http:
        paths:
        - backend:
            service:
              name: b-svc
              port:
                number: 8080
          path: /
          pathType: Prefix
    tls:
    - hosts:
      - b.example.com
      secretName: b-tls
  
  ---
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/enable-cors: &quot;true&quot;
      nginx.ingress.kubernetes.io/auth-url: &quot;https://$host/oauth2/auth&quot;
      nginx.ingress.kubernetes.io/auth-signin: &quot;https://$host/oauth2/start?rd=$escaped_request_uri&quot;
      nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
    labels:
      k8s-app: oauth2-proxy
    name: b-oauth
  spec:
    rules:
    - host: b.example.com
      http:
        paths:
        - backend:
            service:
              name: oauth2-proxy
              port:
                number: 4180
          path: /oauth2
          pathType: Prefix
    tls:
    - hosts:
        - b.example.com
      secretName: b-oauth-tls
  
  </code></pre>
  <p>Obviously, there is only one difference between these two and that is the cors annotations <code>nginx.ingress.kubernetes.io/enable-cors: &quot;true&quot;</code> in the service b ingresses.</p>
  <p>I am not sure of what is causing the issue but I am guessing that the authentication done against Google in service <code>a</code> is not being passed to the CORS request so that the service <code>b</code> can also be authenticate with the same token/credentials.</p>
  <p>What am I doing wrong and how can I resolve this?</p>