Enabling Cross-Origin Resource Sharing with Auth0 for Angular2 authentication
<p>I'm trying to create user authentication via Auth0. I've followed the guide written on their website but I find that authentication fails with a message logged to the console saying <strong>Cross-Origin Resource Sharing is not enabled</strong>.</p>

<p>My <code>auth.service.ts</code> class:</p>

<pre><code>export class AuthService {
  // Configure Auth0
  auth0 = new Auth0({
    domain: myConfig.domain,
    clientID: myConfig.clientID,
    callbackOnLocationHash: true,
    callbackURL: myConfig.callbackURL,
  });

  constructor(private router: Router) {
    var result = this.auth0.parseHash(window.location.hash);

    if (result &amp;&amp; result.idToken) {
      localStorage.setItem('id_token', result.idToken);
      this.router.navigate(['/dashboard']);
    } else if (result &amp;&amp; result.error) {
      alert('error: ' + result.error);
    }
  }

  public login(username: string, password: string) {
    this.auth0.login({
      connection: 'Username-Password-Authentication',
      responseType: 'token',
      email: username,
      password: password,
    }, function(err: any) { if (err) alert("something went wrong: " + err.message); });
  };
}
</code></pre>

<p>I believe I need to add something to the headers, possibly: <code>Access-Control-Allow-Origin: *.auth0.com*</code>, but where would I need to add this and in what format should it be input?</p>

<p>The full error message is the following:</p>

<blockquote>
  <p>Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at <a href="https://[mydomain]/usernamepassword/login" rel="nofollow">https://[mydomain]/usernamepassword/login</a>. (Reason: CORS header 'Access-Control-Allow-Origin' missing). HTTP status code: 400.</p>
</blockquote>

<p>I am currently using the 'lite' Angular2 development server library/process.</p>

<p>The domain name has been added to both the callback and CORS whitelists using the Auth0 dashboard, in the following format:</p>

<pre><code>http://*.[mydomain]*
</code></pre>

<p>I would attempt to add <code>https://*.[mydomain]*</code> to the list and  set an automatic redirect to <code>https://</code> to see if this would help, but the website doesn't seem to like being accessed via https and throws the following error when I attempt to do so:</p>

<blockquote>
  <p>Secure Connection Failed</p>
  
  <p>The connection to www.[mydomain]:3004 was interrupted while the page was loading.</p>
</blockquote>

<p>Perhaps because I haven't got an SSL certificate??</p>