Hi all! I’m working on a web app (SPA) using https://github.com/IdentityModel/oidc-client-js. This library makes a request to

https://<slug>.<http://projects.oryapis.com/.well-known/openid-configuration|projects.oryapis.com/.well-known/openid-configuration>

which fails (in Firefox and Chrome) due to a missing CORS header ‘Access-Control-Allow-Origin’. According to the documentation, adding a custom domain as CORS header is a paid feature. But there must be some other way, right? I tried explicitly setting CORS to

true

or

false

with

ory patch oauth2-config --replace '/serve/public/cors/enabled=false'

, but that did not have any effect. What am I missing? Slack Conversation

Currently you can only set up CORS on a custom domain due to a technical reason in our middleware. We have it on the roadmap to have CORS also on oryapis.com domains. @narrow-van-43826 I think this needs to be fixed

Seems like this is quite limiting usability of the free plan…

For local development and testing you could use the Ory Proxy

Thanks, I tried that, but I was thinking of deploying it.