JordonK.35473 (Customer) asked a question.
Posting here to provide information for anyone who may run into this or has, and may have a better solution.
Our Okta rollout for our SPA using the hosted Okta signin widget (not custom) ran into a roadblock we could not seem to overcome.
The CORS console error:
Access to fetch at 'https://<org>.okta.com/.well-known/webfinger?resource=okta::acct::<user_email>&requestContext=/oauth2/v1/authorize/redirect/okta_key=<key>'' (redirected from 'https://<org>.okta.com/.well-known/webfinger?resource=okta::acct::<user_email>&requestContext=/oauth2/v1/authorize/redirect/okta_key=<key>') from origin 'https://<org>.okta.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
It seems to boil down to how modern browsers handle redirects and how NULL origin headers are added.
We could not find any configuration in the Okta applications or Okta admin settings that would help us get around this.
Below is a screenshot of the changes that needed to be made to the custom signin widget in the Okta admin to get around the CORS error when end users had a Zscaler like application redirecting URLs
Would be great to get other input on better ways around this issue.
Our assumptions are that the unauthenticated FETCH request sent from the base sign-in widget does not send cookies since Okta does not need them, but that means that Zscaler sees that request without the cookies it needs, so it initiates the redirect. That redirect is the root cause of the CORS problem because of how the ORIGIN header is changed in the browser for cross-origin requests.
Is there a better way to override that?
Hello @JordonK.35473 (Customer) Thank you for reaching out to our community!
Please take a look at this article that might provide the response you are looking for:
https://stackoverflow.com/questions/23101138/xmlhttprequest-cannot-load-issue-with-zscaler
My advice would be to leverage the Okta Developer forums for this type of questions and take advantage of their expertise.
https://devforum.okta.com/