Skip to content

The Authorizing OAuth Apps doesn't mention the access_token endpoint doesn't support CORS #22270

Closed
@baywet

Description

@baywet

Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/developers/apps/building-oauth-apps/authorizing-oauth-apps#2-users-are-redirected-back-to-your-site-by-github

What part(s) of the article would you like to see updated?

There should be a mention that CORS pre-flights are not supported on this endpoint (OPTIONS requests). This, and the fact that implicit flow is not supported, effectively means that authenticating from a SPA is impossible without a service relay.
That's unless PKCE is supported, but there are no mentions of it. https://espressocoder.com/2019/10/28/secure-your-spa-with-authorization-code-flow-with-pkce/

Additional information

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    contentThis issue or pull request belongs to the Docs Content teamdevelopersContent related to developershelp wantedAnyone is welcome to open a pull request to fix this issue

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions