Browser cached /oauth2/default/v1/keys causing CORB authentication error

For others experiencing this same problem, I’ve gotten a response from a Developer Support Engineer stating

This is a known feature gap and we have a few other customers facing the same issue. We raised a JIRA OKTA-156155 (Restricting CORS origins for JWKS endpoints causes caching problems with multiple application (across multiple origins)) internally to handle this feature gap. The latest update on the JIRA says that this would be addressed in the Q4 of this year, but we do not have any solid timelines for now.

1 Like