Configuring Client Metadata-based CORS Origin allow list

[panva]

Note

Author: @panva
Target version: ^9.0.0

Warning

No guarantees this is bug-free, if you find a bug please comment on the discussion

import { Provider, errors } from 'oidc-provider'

const corsProp = 'urn:custom:client:allowed-cors-origins';
const isOrigin = (value) => {
  return typeof value === 'string' && URL.parse(value)?.origin === value;
}

new Provider('/* your issuer identifier */', {
  extraClientMetadata: {
    properties: [corsProp],
    validator(ctx, key, value, metadata) {
      if (key === corsProp) {
        // set default (no CORS)
        if (value === undefined) {
          metadata[corsProp] = [];
          return;
        }
        // validate an array of Origin strings
        if (!Array.isArray(value) || !value.every(isOrigin)) {
          throw new errors.InvalidClientMetadata(`${corsProp} must be an array of origins`);
        }
      }
    },
  },
  clientBasedCORS(ctx, origin, client) {
    // ctx.oidc.route can be used to exclude endpoints from this behaviour, in that case just return
    // true to always allow CORS on them, false to deny
    // you may also allow some known internal origins if you want to
    return client[corsProp].includes(origin);
  },
  ...rest // of your configuration
});