Applying CORS Filter to wso2 Identity Server

When we are invoking an endpoint in oauth2 war from a javascript of a web app which is located in a different domain than identity server domain we are getting "No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://XXXXXXX is therefore not allowed access." The issue is occurring as the script on your page is running from a specifc domain and would try to request the resource via an XmlHttpRequest or XDomainRequst from a different domain as this is a cross -origin request.

In order to get rid of this we need to enable this by sending below header using a custom filter.
 Access-Control-Allow-Origin: http://example.com  
(Here  http://example.com is the domain name of where page with that script is hosted)

Invoking UserInfo endpoint of wso2 Identity Server from JavaScript

We have two possible solutions to apply the CORS header. 

1. Customizing OpenIDConnectUserEndpoint.java as below and replacing the oauth2.war. 

We can introduce below header to getUserClaims(). By applying this filter it allows to invoke OpenIDConnectUserEndpoint from 'http://example.com'

domain. If we put '*' instead of 'http://example.com' it allows to invoke this endpoint from any domain. But it leads to some security risks. 

respBuilder.header("Access-Control-Allow-origin" , 'http://example.com') 

 

Note:Customizing the endpoint to allow cross origin communication and replacing the war is not actually recommended. 

2. Applying CORS Filter 

We have a cors-filter [1][2] which is already used in oauth webapp of wso2 Identity Server and we need to do following configuration changes to web.xml located in {Product_Home}/repository/deployment/server/webapps/oauth2/WEB-INF in order to add above mentioned header.

Enable to CORS filter for oauth webapp by adding the filter configuration to web.xml as below.

<filter>
        <filter-name>CORS</filter-name>
        <filter-class>com.thetransactioncompany.cors.CORSFilter</filter-class>

        <init-param>
                <param-name>cors.allowOrigin</param-name>
                <param-value>http://example.com</param-value>
        </init-param>
</filter>
<filter-mapping>
  <filter-name>CORS</filter-name>
  <url-pattern>/example.html</url-pattern>
</filter-mapping>

You can provide whitespace-separated list of origins that the CORS filter must allow as cors.allowOrigin. But please make sure to not to use wild cards as * as it allows any origin and it may lead to some security vulnerabilities. 

 [1] http://software.dzhuvinov.com/cors-filter-configuration.html

 [2] http://software.dzhuvinov.com/cors-filter.html

In oauth2.war as we have already included the dependency we don't need to separately add it to the pom.xml file. But if you are using another endpoint you need to add the dependency too as below.

Applying CORS Filter to other webapp

1.. Add the following module to the dependencies section of pom.xml

 <dependency>
            <groupId>com.thetransactioncompany.wso2</groupId>
            <artifactId>cors-filter</artifactId>
            <version>1.7.0.wso2v1</version>
</dependency>

2. Enable to CORS filter for webapp by adding the filter configuration to web.xml in {sample_web_app}/src/main/webapp/WEB-INF directory as above mentioned in the second approach.