Dex: Documentation for Cors configuration

[rithujohn191]

[ericchiang]

In addition, if someone has allowed the public flow AND hasn't added a specific CORs profile, we should just default to a basic CORs profile that makes public flows work. This would make this just kinda work out of the box instead of blowing up due to CORs.

[agentgonzo]

Could someone provide some guidance on how to set this up in the configs?
I've added the following to the config:

web:
  allowedOrigins: ['*']

And can see that this is getting picked up in the logs:
time="2018-04-10T15:18:11Z" level=info msg="config allowed origins: [*]"

However, when by browser does the pre-flight OPTIONS request to the /auth endpoint, it's returning a 302 to the upstream login provider (google in our case) without the CORS headers.
The browser then raises an error because it needs a 200 response from the options request.

Checking this with curl:

$ curl -X OPTIONS "http:/dex.example.com/auth?client_id=..."
HTTP/1.1 302 Found
Location: /auth/google?req=zqvxnvtgkvv6zu4sebtzwy324
Date: Tue, 10 Apr 2018 15:36:59 GMT
Content-Length: 0
Content-Type: text/plain; charset=utf-8

[malikimprowised]

Any update on this issue? Do you have added support for CORS?