Returns origin 'null' while login into okta signin widget

Questions
1

Hi,

Kony is a hybrid platform, where we can create Desktop and Native application. Here I tried ‘Okta signin widget’ . In Desktop application I have received CORS issue, and it is resolved by adding origin in trusted origins list.

But, while running my same application in Android, it returns below error.

“Access to XMLHttpRequest at ‘https://dev-693352.okta.com/api/v1/authn’ from origin ‘null’ has been blocked by CORS policy: Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’ header is present on the requested resource.”, source: file:///android_asset/web/localfiles/login.html

How can I resolved origin ‘null’ issue? Please help me on this.

<!DOCTYPE html>
<html>
   <head>
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width, initial-scale=1">
      <script src="https://global.oktacdn.com/okta-signin-widget/4.1.4/js/okta-sign-in.min.js" type="text/javascript"></script>
      <link href="https://global.oktacdn.com/okta-signin-widget/4.1.4/css/okta-sign-in.min.css" type="text/css" rel="stylesheet"/>
   </head>
   <body>
      <div id="widget-container"></div>
      <script>
         var config = {
           baseUrl: 'https://dev-693352.okta.com/oauth2/default',
           logo: 'https://i.ibb.co/9ZWrKSy/Daco-5515596.png',
           logoText: '',
           helpSupportNumber: '(123) 456-7890',
           language: 'en',
           i18n: {
             en: {
               'primaryauth.title': 'Welcome to Canadian Western Bank'
             }
           },
           helpLinks: {
             help: 'https://acme.com/help'
           },
           headers: {
         },
           authParams: {
           }
         };
         var signIn = new OktaSignIn(config);
         signIn.renderEl({
           el: '#widget-container',
         }, function success(res) {
           if (res.status === 'SUCCESS') {
             console.log('Do something with this sessionToken', res.session.token);
             
             var queryString = "?Token=" + res.session.token ; 
             HTMLFunctionOnClick(queryString);
                     } else {
                     }
         });
         
         signIn.showSignInToGetTokens({
           clientId: '0oaoh8g86UNvF6zS94x6',
         
           
           redirectUri: 'http://localhost:8080/authorization-code/callback',
         
           // Return an access token from the authorization server
           getAccessToken: true,
         
          
           getIdToken: true,
           scope: 'openid profile'
         });
      </script>
   </body>
</html>
<html>
   <head>
      <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
      <meta name="Robots" content="NOINDEX " />
   </head>
   <body></body>
   <script type="text/javascript">
      function HTMLFunctionOnClick(queryString){
        console.log("HTMLFunctionOnClick called");
       
        var json_obj = {"token":queryString};
      kony.evaluateJavaScriptInNativeContext("navigateToAnotherForm("+JSON.stringify(json_obj)+")");
      }
      var gearPage = document.getElementById('GearPage');
      if(null != gearPage)
      {
        gearPage.parentNode.removeChild(gearPage);
        document.title = "Error";
      }
   </script>
</html>

Thanks,
Lokesh

2

@lokeswara.rao The /localfiles/login.html endpoint is not CORS enabled. The best solution is to redirect the user in the browser to this endpoint (or use a specific logout endpoint provided by the SAML app or OIDC app that you are using in Okta).
Let me know if this is helpful

3

Hi @lokeswara.rao,

Could you tell us what type of client application is configured in okta for your app?

Could you check the network traces and confirm the value in the Origin header of the /authn request ? It looks like the origin header is not set or null is being passed.