# Authorization with OKTA fails due to CORS (Access-Control-Allow-Origin) **URL:** \ **Category:** Questions\ **Created:** [November 20, 2020, 2:59pm UTC](https://devforum.okta.com/t/authorization-with-okta-fails-due-to-cors-access-control-allow-origin/11842 "2020-11-20T14:59:55Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![lkwid](https://avatars.discourse-cdn.com/v4/letter/l/96bed5/32.png) [@lkwid](https://devforum.okta.com/u/lkwid)\ **Post date:** [November 20, 2020, 2:59pm UTC](https://devforum.okta.com/t/authorization-with-okta-fails-due-to-cors-access-control-allow-origin/11842/1 "2020-11-20T14:59:55Z")
In our setup we have a frontend and backend on different servers with OKTA being our identity manager. Most of the communication is being done with the graphql and it works like a charm. However recently we had a use case where the good ol’ REST was a better choice. To make a long story short, a request coming from the frontend side has been blocked due to CORS, now let me take you to the details. 1. I have a CORS policy set on the backend, allowing calls from the defined origins (including localhost). I am using wildcards for headers and methods. Same addresses have been added to OKTA’s Trusted Origins. This setup works flawlessly with graphql requests, no issue so far. 2. This week I have added a couple of REST endpoints and our problems began. All requests have been failing due to CORS, and the error message was pointing at `/oauth2/authorization/okta` (Access-Control-Allow-Origin header is missing). I’ve managed to overcome this issue by adding the backend URI to OKTA’s Trusted Origins, what takes us to the point number 3. 3. Right here I hit the wall. I’m receiving the same error message as at #2 (Access-Control-Allow-Origin header is missing), however I can see my OKTA’s authorization server URI in the error message: `https://dev-xxxxxx.okta.com/oauth2/default/v1/authorize?response_type=code&client_id=...` What am I missing? ---
**Author:** ![Lijia](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/lijia/32/2295_2.png) [@Lijia](https://devforum.okta.com/u/Lijia)\ **Post date:** [November 23, 2020, 11:47pm UTC](https://devforum.okta.com/t/authorization-with-okta-fails-due-to-cors-access-control-allow-origin/11842/2 "2020-11-23T23:47:26Z")
@lkwid Hi, can you please confirm the below questions? 1. Do you have the access to [https://dev-xxxxxx.okta.com/oauth2/default/.well-known/openid-configuration](https://dev-xxxxxx.okta.com/oauth2/default/.well-known/openid-configuration). To test this, you can open the URL in the browser and see if you have the access. 2. Is it possible to know which specific API you use when you first time having the error? 3. Could you please attach the screenshots? - error msg - trusted origin settings - Application general tab – redirect URL ---
**Author:** ![lkwid](https://avatars.discourse-cdn.com/v4/letter/l/96bed5/32.png) [@lkwid](https://devforum.okta.com/u/lkwid)\ **Post date:** [November 25, 2020, 12:29pm UTC](https://devforum.okta.com/t/authorization-with-okta-fails-due-to-cors-access-control-allow-origin/11842/3 "2020-11-25T12:29:11Z")
Hi @Lijia. 1. Yes, I have an access to ‘…/oauth2/default/.well-known/openid-configuration’ 2. Sorry Lijia, I’m not sure what is on your mind here. Hopefully the screenshot below brings the answer 3. Screenshot: ![error](https://global.discourse-cdn.com/oktadev/original/2X/9/9c427feb79ee61a2e33ae3d242639b3d726894ad.png) Trusted origins: ![trusted_origins](https://global.discourse-cdn.com/oktadev/original/2X/4/498b37fb212eb47838578bb0679aa64c53546806.png) Login redirect: ![login_redirect](https://global.discourse-cdn.com/oktadev/original/2X/e/eccc0832b36d4bb7f5abe3bb7efe8a5857c3cb94.png) Sign on tab: ![sign_on](https://global.discourse-cdn.com/oktadev/original/2X/7/7630280fd3f2c0b29a1c24129331915a729b5c07.png) Sorry for the mess with all these URIs and Origins. We were trying many different options lately… ---
**Author:** ![Lijia](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/lijia/32/2295_2.png) [@Lijia](https://devforum.okta.com/u/Lijia)\ **Post date:** [November 25, 2020, 7:29pm UTC](https://devforum.okta.com/t/authorization-with-okta-fails-due-to-cors-access-control-allow-origin/11842/4 "2020-11-25T19:29:53Z")
@lkwid Hi, I was wondering if you have the access to metadata URL and if configure localhost URL well. It looks like you did both correctly. It could be easier to discuss the issue in a remote meeting session. Can you please open a support ticket through an email to [support@okta.com](mailto:support@okta.com)? ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [January 19, 2024, 1:02am UTC](https://devforum.okta.com/t/authorization-with-okta-fails-due-to-cors-access-control-allow-origin/11842/5 "2024-01-19T01:02:56Z")