Allow CORS requests to JWK Set endpoint

[dgt-amexio]

Describe the bug
CORS issue with /oauth2/jwks endpoint

To Reproduce
Integrate spring-authorization-server in a SpringBoot Application
(following example provided in repo : https://github.com/spring-projects-experimental/spring-authorization-server/tree/master/samples/boot/oauth2-integration/authorizationserver)

Call the /oauth2/jwks endpoint from a JS application (or through any REST Client)

Expected behavior
The associated endpoint should allow CORS requests, but it doesn't.
Usual Spring mechanisms tested, but I seems that the JwkSetEndpointFilter behaviour could not be overriden to allow CORS requests.

Question : how could the service be configured in order to allow CORS requests on /oauth2/jwks ?

Sample
Use https://github.com/spring-projects-experimental/spring-authorization-server/tree/master/samples/boot/oauth2-integration/authorizationserver

[jgrandja]

Thanks for the report @dgt-amexio.

I'm able to access http://localhost:9000/oauth2/jwks (from the sample) using a browser or Postman.

Call the /oauth2/jwks endpoint from a JS application (or through any REST Client)

I'm curious why you need to call the endpoint from a JS application? Can you provide more details on your use case/flow?

[dgt-amexio]

Hello,
Sorry for my late answer, due to holidays.

My use case is to assess whether this library could be used as the backbone of a custom OpenID Connect service.
To achieve this,

• I created a SpringBoot application using spring-authorization-server as a dependency + adding an extra "./well-known/openid-configuration" endpoint
• I then tried to reference this SB application in an Angular app relying on angular-oauth2-oidc (which brings OIDC client logic in Angular apps)

When attempting to perform authentication, the following calls are performed from my Angular app to the SB app (let's suppose this SB app is accessible on https://server) :

• GET https://server/.well-known/openid-configuration > returns a HTTP 200 status (OK) and provides OpenID config as per my custom openid-configuration endpoint
• GET https://server/oauth2/jwks > raises a "Access to XMLHttpRequest at 'https://server/oauth2/jwks' from origin 'https://localhost:4200' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource."

The question is "how could I configure spring-authorization-server to define the proper Access-Control-Allow-Origin strategy ?

[jgrandja]

Thanks for the feedback @dgt-amexio.

As a temporary workaround, instead of @Import(OAuth2AuthorizationServerConfiguration.class) you could simply define your own WebSecurityConfigurerAdapter similar to OAuth2AuthorizationServerSecurity and additionally configure CORS using http.cors() or supplying a CorsConfigurationSource @Bean. This should at least get you moving forward.

We'll address this issue soon.

[jgrandja]

@dgt-amexio We decided NOT to provide a default configuration for CORS in OAuth2AuthorizationServerSecurity. The primary reason is that it would open up the potential attack surface and we need to maintain a tight security boundary.

However, I added a minor enhancement that will allow you to inherent the default configuration and enhance it with your custom CORS configuration.

Here is a sample of the full configuration:

@Configuration(proxyBeanMethods = false)
public class AuthorizationServerConfig {

	@EnableWebSecurity
	public class AuthorizationServerSecurity extends WebSecurityConfigurerAdapter {

		@Override
		protected void configure(HttpSecurity http) throws Exception {
			OAuth2AuthorizationServerSecurity.applyDefaultConfiguration(http);
			http.cors().configurationSource(corsConfigurationSource());
		}
	}

	@Bean
	public CorsConfigurationSource corsConfigurationSource() {
		CorsConfiguration config = new CorsConfiguration();
		config.addAllowedOrigin("http://localhost:8080");
		config.addAllowedHeader("*");
		config.addAllowedMethod("GET");

		UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
		source.registerCorsConfiguration("/oauth2/**", config);

		return source;
	}

	// @formatter:off
	@Bean
	public RegisteredClientRepository registeredClientRepository() {
		RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
				.clientId("messaging-client")
				.clientSecret("secret")
				.clientAuthenticationMethod(ClientAuthenticationMethod.BASIC)
				.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
				.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
				.redirectUri("http://localhost:8080/authorized")
				.scope("message.read")
				.scope("message.write")
				.clientSettings(clientSettings -> clientSettings.requireUserConsent(true))
				.build();
		return new InMemoryRegisteredClientRepository(registeredClient);
	}
	// @formatter:on

	@Bean
	public KeyManager keyManager() {
		return new StaticKeyGeneratingKeyManager();
	}

	// @formatter:off
	@Bean
	public UserDetailsService users() {
		UserDetails user = User.withDefaultPasswordEncoder()
				.username("user1")
				.password("password")
				.roles("USER")
				.build();
		return new InMemoryUserDetailsManager(user);
	}
	// @formatter:on
}

Let me know if you have any questions.

[dgt-amexio]

works like a charm !
Thx