client: client specific CORS settings

[ayZagen]

It would be great to have the ability to set client specific allowed origins.

[aeneasr]

Please provide more context:

• Which endpoints should be affected?
• What's the use case?
• Does this exist in the wild, and if so, where?

Thank you!

[ayZagen]

Taken from Auth0

Allowed Origins are URLs that will be allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if you need to. You can specify multiple valid URLs by comma-separating them or one by line, and also use wildcards at the subdomain level (e.g.: https://*.contoso.com). Notice that querystrings and hash information are not taking into account when validating these URLs.

[aeneasr]

Right, but in this case this would be only the /oauth2/token and /oauth2/revoke endpoints, as all other endpoints do not have a concept of request ownership. Does that cover your use case?

[ayZagen]

Also /oauth2/auth ?

[aeneasr]

That endpoint is only accessed by the user through the browser directly, no CORS needed here.

[aeneasr]

Closed by #1009