Auth0.js: Cannot update user with patchUserMetadata()

[Markus-ipse]

When trying to update a users meta data from my Angular 2 application using the auth0-client the preflight request is rejected with the following message:

XMLHttpRequest cannot load https://XXXXX.eu.auth0.com/api/v2/users/auth0%XXXXXX. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:4200' is therefore not allowed access.

// simplified for brevity

@Injectable()
export class AuthService {

  webAuth = new Auth0.WebAuth(authConfig);
  management: any;

  auth0UserProfile: Auth0UserProfile;

  constructor() {

    if (!window.location.hash) { return; }

    this.webAuth.parseHash(window.location.hash, (err, authResult) => {
      if (err) { return console.error('Failed to login:', err); }

      window.localStorage.setItem('id_token', authResult.idToken);

      // relevant part
      this.management = new Auth0.Management({
        domain: authConfig.domain,
        token: authResult.idToken
      });

      this.webAuth.client.userInfo(authResult.accessToken,  (err, profile) => {

        window.localStorage.setItem('profile', JSON.stringify(profile));
        this.auth0UserProfile = profile;

      });

    });

  }

  public login() {
    this.webAuth.authorize({
      responseType: 'token',
      redirectUri: window.location.origin
    });
  }

  // Other relevant part. This is the part that fails.
  private updateUser(data) {
    this.management.patchUserMetadata(this.auth0UserProfile.user_id, data, (err, profile) => {
      if (err) return console.error('Failed to update user', err);

      this.auth0UserProfile = profile;
      localStorage.setItem('profile', JSON.stringify(profile));
    });

  }

}

Headers for the failing request

Calls to WebAuth.authorize() webAuth.changePassword() do work fine however.

[niklasbuschmann]

I have the exact same issue, also with simple GET requests, it seems like the server has a problem with the auth0-client http-header, as the OPTIONS request is rejected with CORS error: Some headers are not allowed.

If I replace the request made by auth0-js with a exact replication using window.fetch() I get the same error, but if I omit the auth0-client header, everything works fine.

So seems like the server software needs to be patched ...

[niklasbuschmann]

var setRequestHeader = XMLHttpRequest.prototype.setRequestHeader;
XMLHttpRequest.prototype.setRequestHeader = function (header, value) {
  if (header === 'Auth0-Client')
    return false;
  return setRequestHeader.call(this, header, value);
};

This horrible monkey-patch code also fixes the problem ....

[RobinJayaswal]

Any update on this? This prevents me from being able to let the user update their user metadata on the client, and am wondering if I will need to work around this by using the backend SDK for this task, or if this is going to be fixed sometime soon.

[hzalaz]

@RobinJayaswal I've asked to patch the backend for this header, you can make the request yourself using client side since it's just a simple PATCH.
Once I know it's patched I'll notify.

[the-s0urce]

Instead of this "horrible monkey-patch", you can just set the option _sendTelemetry to false. This does the same: Not set the auth0-client to header. It did the trick for me.

var auth0Manage = new Auth0.Management({
domain: config.Domain,
token: result.idToken,
_sendTelemetry: false
});

And for all looking for an jQuery ajax solution, this was my workaround before I found this option:

    var patchUserMetadata = function(idToken,userId,user_metadata){
        return $.ajax({
            type: 'PATCH',
            url: 'https://' + config.Domain +'/api/v2/users/' + userId,
            data: { 'user_metadata': user_metadata},
            headers: {'Authorization': 'Bearer ' + idToken}
        }); // (this returns jQuery´s promise object)
    }

[hzalaz]

We have submitted the issue to the api backend team and the fix should be merged by EOW. Will post here once the fix is deployed

[aneshas]

Is there any update on this, I created new account/tenant cors failing on multiple endpoints even though the config is correct. Is this happening only on free accounts, would it be fixed if upgraded to paying??

[luisrudge]

@tonto this shouldn't be happening at all. What endpoints are failing?

[aneshas]

oauth/ro

https://xxx.eu.auth0.com/oauth/ro: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://xxx.com' is therefore not allowed access.

and

https://crypto-shop.eu.auth0.com/passwordless/verify

both using auth0.js

or do cors origins for those apis need to be setup somewhere other than client settings page?

[luisrudge]

No. The config is in the same page. This doesn't look like a bug in the SDK. Can you please open a ticket at https://support.auth0.com so they can route this to the backend team? Paste the ticket number here so I can ping someone internally after that. Thanks!

[aneshas]

@luisrudge Ticket number: 35070 Thanks

[aneshas]

@luisrudge and whoever else, I'm sorry but this is getting reaaallyyy realllyyy frustrating. I posted a ticket like you said, 4 days gone and no response at all!!! Can you please ping someone about this.

I am not the only one, there are at least 5 threads posted recently about CORS issues, but no one is getting any response at all from you guys. Like, what is the deal here ???? Do I need to upgrade my account to paying customer. If yes just say so I will if that will resolve the issue. But this is highly unprofessional behavior. What is the deal here?????? Can we pleeeasssee get any responses from you guys are you working on it, is it us https://community.auth0.com/questions/13605/cors-error-despite-correct-settings-in-newly-creat ???

Maybe it's not your team in charge but you are in the same organization, communicate for gods sake !

Who do we have to contact, who can respond (support tickets are out of the question, since no one is responding) !!!

[luisrudge]

Hey! Sorry about the wait. I just pinged someone internally about this. I'll follow up with them on monday.

[aneshas]

@luisrudge Thanks