Simple Same-Origin Requests Fail Due to Origin Check about nginx_oauth_proxy_module HOT 2 CLOSED

Had the same #24
I ended up tweaking the code to ignore origin checks if header does not exist.

after all, cors is a ua security enforcement so we have to trust the browser logic.

from nginx_oauth_proxy_module.

Thanks for pointing this out. There is a 1.2.0 release that fixes this issue. You need to set cors_enabled to off as follows for samesite deployments. The origin header will continue to be checked for data changing commands:

oauth_proxy on;
    oauth_proxy_cookie_name_prefix "example";
    oauth_proxy_encryption_key "4e4636356d65563e4c73233847503e3b21436e6f7629724950526f4b5e2e4e50";
    oauth_proxy_trusted_web_origin "https://demo1.example.com";
    oauth_proxy_cors_enabled off;
}

We have made an equivalent CORS_ENABLED environment variable to OAuth Agent components, which should also be set to false in samesite setups.

See these PRs:

• #25
• curityio/oauth-agent-node-express#18

from nginx_oauth_proxy_module.