Question about CORS

[ovizii]

Your documentation suggests:

[server.http]
allowed-origins = ["https://your-bulwark-domain.com"]

Btu again, the stalwart docs do not have any information about this setting. Somebody please clarify.

[rathlinus]

Also correct, i will double check all docs as this is inherited

[ovizii]

Need some more help. I think I finished configuring bulwark but when I access it, without clicking on login via OIDC, just after the front-page finishes loading, I see this error in the browser console and am unsere if I got it right:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://auth.dom.tld/.well-known/oauth-authorization-server. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 200.

Does this mean I need to fix something on bulwark's side or on my auth/oidc side?

[rathlinus]

That would need a fix on the auth server

[rathlinus]

i think you need something like this nginx example:

location /.well-known/ {
add_header Access-Control-Allow-Origin "https://mail.server.example" always;
add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
add_header Access-Control-Allow-Headers "Authorization, Content-Type" always;
proxy_pass http://auth.server.example;
}

[ovizii]

Thanks, I started reading up on CORS, but the message sounded a bit confusing and I wasn't sure on which side I need to apply the fix.

[chrilep]

Whenever a website (eg. Bulwark) accesses another website the another one must allow the first one to do it. If the another site cannot be configured to do it you need a reverse proxy in front of the another site.

Stalwart must allow Bulwark. Auth server must allow Bulwart, etc...

[ovizii]

Apologies, I was a bit confused. The error I mentioned above is actually irrelevant. I found this portion of your docs which explains it:

Endpoints are auto-discovered via /.well-known/oauth-authorization-server or /.well-known/openid-configuration.

The other one, actually worked flawlessly: /.well-known/openid-configuration the browser just reports the former one as my IDP does not offer that.

I can now click on login with OIDC, but I get rejected in the end. Its about CORS for stalwart. I have enabled permissive CORS and restarted stalwart already.

Any advice? Any details I should check out with those errors that might help diagnose?

[ovizii]

I figured it out. I made a mistake when selecting the directory in the stalwart settings. Now that I have selected OIDC as directory I can log in and finally test bulwark :-)