{"action":"created","issue":{"url":"https://api.github.com/repos/thomseddon/node-oauth2-server/issues/171","labels_url":"https://api.github.com/repos/thomseddon/node-oauth2-server/issues/171/labels{/name}","comments_url":"https://api.github.com/repos/thomseddon/node-oauth2-server/issues/171/comments","events_url":"https://api.github.com/repos/thomseddon/node-oauth2-server/issues/171/events","html_url":"https://github.com/thomseddon/node-oauth2-server/issues/171","id":67897836,"number":171,"title":"Add CORS feature to support AJAX use of password grant flow","user":{"login":"bertramn","id":3828133,"avatar_url":"https://avatars.githubusercontent.com/u/3828133?v=3","gravatar_id":"","url":"https://api.github.com/users/bertramn","html_url":"https://github.com/bertramn","followers_url":"https://api.github.com/users/bertramn/followers","following_url":"https://api.github.com/users/bertramn/following{/other_user}","gists_url":"https://api.github.com/users/bertramn/gists{/gist_id}","starred_url":"https://api.github.com/users/bertramn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bertramn/subscriptions","organizations_url":"https://api.github.com/users/bertramn/orgs","repos_url":"https://api.github.com/users/bertramn/repos","events_url":"https://api.github.com/users/bertramn/events{/privacy}","received_events_url":"https://api.github.com/users/bertramn/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-04-12T10:21:00Z","updated_at":"2015-04-16T15:15:19Z","closed_at":null,"body":"Hi there,\r\n\r\nI am using the password grant flow via an ajax call where the requesting app is not running on the same domain as the OAuth server. Without CORS headers, the oauth password grant flow from a web client posting to the oauth server does not work. I did see some people just globally adding the CORS headers in the oauth server middleware or the fronting apache proxy, e.g.\r\n\r\n```js\r\napp.use(function (req, res, next) {\r\n    res.header('Access-Control-Allow-Origin', 'http://localhost:8100');\r\n    res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE');\r\n    res.header('Access-Control-Allow-Headers', 'Content-Type');\r\n    next();\r\n});\r\n```\r\n\r\nMaking CORS part of the client configuration will enable a per client configuration. The only thing that needs to be added is a configuration property to the client like `client.addCorsHeader` and for the actual header to be returned one could use the `client.redirectUri` parameter on the client. If the `addCorsHeader` property is enabled, simply strip off the path from the client redirectUri and return this in the `Access-Control-Allow-Origin` header with the response.\r\n\r\nEt voila the OAuth server would now support CORS multiple different oauth clients that call from different domains using the password grant.\r\n\r\nDoes that work as a proposal and more importantly would this be a valid use case?\r\n\r\nCheers, Niels\r\n\r\n\r\nDetailed use case:\r\n\r\nOAuth server running on `https://oauth.fancydomain.com`\r\nClient App running on `https://myclient.com`\r\n\r\nClient App client is configured like:\r\n```json\r\n{\r\n    \"clientId\" : \"id123\",\r\n    \"clientSecret\" : \"some client secret\",\r\n   \"addCorsHeader\": true,\r\n    \"redirectUri\" : \"https://myclient.com/#/app/login\"\r\n}\r\n```\r\n\r\nOAuth server and Client App are from the same developer and the Client App only wants to post following to get an access token for use of some other backend API that is a protected resource server:\r\n```\r\nPOST /oauth/token HTTP/1.1\r\nHost: oauth.fancydomain.com\r\nCache-Control: no-cache\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\ngrant_type=password&username=somedude&password=secret&client_id=id123\r\n```\r\n\r\nThe response the client is after will look something like this:\r\n```\r\nRemote Address: oauth.fancydomain.com\r\nRequest URL: https://oauth.fancydomain.com/oauth/token\r\nRequest Method: POST\r\nStatus Code: 200 OK\r\nAccess-Control-Allow-Headers: Content-Type\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE\r\nAccess-Control-Allow-Origin: https://myclient.com\r\n...\r\nContent-Type: application/json; charset=utf-8\r\n\r\n{\"token_type\":\"bearer\",\"access_token\":\"a29fe185e2529917e7c778fb9b748a0912f030af\",\"expires_in\":2400}\r\n```\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/thomseddon/node-oauth2-server/issues/comments/93760438","html_url":"https://github.com/thomseddon/node-oauth2-server/issues/171#issuecomment-93760438","issue_url":"https://api.github.com/repos/thomseddon/node-oauth2-server/issues/171","id":93760438,"user":{"login":"maennchen","id":333918,"avatar_url":"https://avatars.githubusercontent.com/u/333918?v=3","gravatar_id":"","url":"https://api.github.com/users/maennchen","html_url":"https://github.com/maennchen","followers_url":"https://api.github.com/users/maennchen/followers","following_url":"https://api.github.com/users/maennchen/following{/other_user}","gists_url":"https://api.github.com/users/maennchen/gists{/gist_id}","starred_url":"https://api.github.com/users/maennchen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/maennchen/subscriptions","organizations_url":"https://api.github.com/users/maennchen/orgs","repos_url":"https://api.github.com/users/maennchen/repos","events_url":"https://api.github.com/users/maennchen/events{/privacy}","received_events_url":"https://api.github.com/users/maennchen/received_events","type":"User","site_admin":false},"created_at":"2015-04-16T15:15:19Z","updated_at":"2015-04-16T15:15:19Z","body":"You can configure your /authorize Endpoint that it does the redirect directly without comfirmimg if the user allready did once.\r\nFor CORS there are many plugins available which do just that.\r\nHave a look at this project: https://www.npmjs.com/package/express-cors"}}