We probably need some more context. How is the backend configured? How or what front-end client code is making the requests for authentication and authorization?
If you are loading something from the file system, you will have a null origin.
As far as I can see, CORS is configured correctly. I also allow CORS Requests from other domains, where everything is working correctly.
My Spring configuration allows
Can you double check if you are able to use the “Default” Authorization Server I see in your authorize request? If you log into the Admin Console, can you navigate to Security → API → Authorization Servers, or is that tab missing for you?
You’ll get a CORS error if you try to hit an endpoint that does not exist, such as and oauth endpoint for a non-existent authorization server.
It seems that in our case the problem is that the request sent by https://dev-idnumber.okta.com to our application does not contain an ‘origin’ header stating it is coming from the okta.com domain. @andrea is it possible to add this header? if not, it will impossible to enable CORS in our application.
Please note that the issue in our case is not the okta server blocking our server’s requests (and therefore adding our server as an authorized origin in the API tab will not help) but rather the opposite : we cannot judge whether an incoming request comes from an authorized domain without the origin header.
Did anyone ever figure this out? I’m getting the same issue (Origin is null when redirected to my app after successful login from an Okta dev account) however this time with SAML login. Adding “*” to allow all origin is not acceptable for us. Is there some configuration I’m missing?
For anyone with the same issue, it appears that this only occurs when using Okta with a localhost app. Once your app is visible on a real domain the Origin header from Okta is set correctly, at least it is for me.
