Zitadel intercepts with wildcard CORS headers which are not configurable
āļøConfigurationš¬Self-hostedāļøāš„APIsāQuestionšŖ²Bugs
Hi,
It looks like for the most of the url paths zitadel intercepts/adds its own CORS headers (Access-Control-Allow-Origin header for e.g.) which is the wildcard one (allows all). Which means - whatever "Origin" header the browser is sending, the CORS will ALWAYS accept it.
Also we haven't found the way to configure this setting (either to enable/disable it, or to modify).
The url paths for which the zitadel injects CORS:
"/.well-known/",
"/oauth/",
"/oidc/",
"/idps/callback/",
"/saml/",
<all API endpoints>
What was the intention for this decision? Can this be considered as a security flaw?
It looks like for the most of the url paths zitadel intercepts/adds its own CORS headers (Access-Control-Allow-Origin header for e.g.) which is the wildcard one (allows all). Which means - whatever "Origin" header the browser is sending, the CORS will ALWAYS accept it.
Also we haven't found the way to configure this setting (either to enable/disable it, or to modify).
The url paths for which the zitadel injects CORS:
"/.well-known/",
"/oauth/",
"/oidc/",
"/idps/callback/",
"/saml/",
<all API endpoints>
What was the intention for this decision? Can this be considered as a security flaw?
