# CORS policy is not being applied to /oauth2/default/v1/keys

**URL:** <https://devforum.okta.com/t/cors-policy-is-not-being-applied-to-oauth2-default-v1-keys/7504>\
**Category:** Questions\
**Created:** [January 2, 2020, 5:47pm UTC](https://devforum.okta.com/t/cors-policy-is-not-being-applied-to-oauth2-default-v1-keys/7504 "2020-01-02T17:47:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vladimirm](https://avatars.discourse-cdn.com/v4/letter/v/6de8d8/32.png) [@vladimirm](https://devforum.okta.com/u/vladimirm)\
**Post date:** [January 2, 2020, 5:47pm UTC](https://devforum.okta.com/t/cors-policy-is-not-being-applied-to-oauth2-default-v1-keys/7504/1 "2020-01-02T17:47:21Z")

</div>

Hello all,

I am pretty new to using Okta and perhaps I am missing something. I’ve used Okta example for vue and implemented a very simple application that is supposed to authenticate with Okta. I am sure that I have seen it working a few days back.

However, today when I tried to do the authentication I started to receive following message in console:

Access to XMLHttpRequest at ‘https://\*\*\*\*\*\*.okta.com/oauth2/default/v1/keys’ from origin ‘[http://localhost:8080](http://localhost:8080)’ has been blocked by CORS policy: No ‘Access-Control-Allow-Origin’ header is present on the requested resource.

My trusted origins are set. And token POST request returns proper Access-Control… however, GET keys is missing the whole header.

Does anybody else having same issues?

Thanks!  
~Vlad

---

<div class="post-metadata">

**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\
**Post date:** [January 3, 2020, 4:10am UTC](https://devforum.okta.com/t/cors-policy-is-not-being-applied-to-oauth2-default-v1-keys/7504/2 "2020-01-03T04:10:45Z")

</div>

Hi @vladimirm

If you access the endpoint /oauth2/default/v1/keys in the browser, do you receive a 200 response with the signing keys?

Also, if you run this example, does it display the signing keys?

```auto
var url = 'https://yourDomainHere.okta.com/oauth2/default/v1/keys';
var xhr = new XMLHttpRequest();
if ("withCredentials" in xhr) {
    xhr.onerror = function() {
      console.log('Invalid URL or Cross-Origin Request Blocked. You must explicitly add this site (' + window.location.origin + ') to the list of allowed websites in the administrator UI');
    }
    xhr.onload = function() {
        console.log(this.responseText);
    };
    xhr.open('GET', url, true);
    xhr.send();
} else {
    console.log("CORS is not supported for this browser!")
}
</script>

```

---

<div class="post-metadata">

**Author:** ![vladimirm](https://avatars.discourse-cdn.com/v4/letter/v/6de8d8/32.png) [@vladimirm](https://devforum.okta.com/u/vladimirm)\
**Post date:** [January 3, 2020, 8:41am UTC](https://devforum.okta.com/t/cors-policy-is-not-being-applied-to-oauth2-default-v1-keys/7504/3 "2020-01-03T08:41:22Z")

</div>

Hello @dragos,

Thanks for answering. Yes I was receiving a 200 response. However, after your response I went again to check the console and noticed that for some reason keys are being served from the cache. Clearing the browser cache resolved the problem.

~Vlad

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 23, 2024, 7:42pm UTC](https://devforum.okta.com/t/cors-policy-is-not-being-applied-to-oauth2-default-v1-keys/7504/4 "2024-01-23T19:42:24Z")

</div>

Closed on January 23, 2024, 7:42pm UTC

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.