Closed
Description
Code of Conduct
- I have read and agree to the GitHub Docs project's Code of Conduct
What article on docs.github.com is affected?
What part(s) of the article would you like to see updated?
There should be a mention that CORS pre-flights are not supported on this endpoint (OPTIONS requests). This, and the fact that implicit flow is not supported, effectively means that authenticating from a SPA is impossible without a service relay.
That's unless PKCE is supported, but there are no mentions of it. https://espressocoder.com/2019/10/28/secure-your-spa-with-authorization-code-flow-with-pkce/
Additional information
No response