Endpoint /login/oauth/access_token doesn't return Access-Control-Allow-Methods

[esfraner]

• Gitea version (or commit ref): bd55f6f
• Git version: 2.11.0
• Operating system: Linux debian
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • [x ] Not relevant
• Log gist:

Description

Endpoint /login/oauth/access_token doesn't return Access-Control-Allow-Methods and give me CORS problem.
...

Screenshots

....

[zeripath]

What should it return exactly?

[esfraner]

@zeripath, as you can see, in this GET method, appears Access-Control-Request-Method with its method:
(No problem with the error 403, I only have to make a test OPTIONS request to show).

Then the request that I did to endpoint /login/oauth/access_token should have this header.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

[sebastianwindeck]

Is this issue solved?
I tried to access the endpoint from another resource for dev purpose
with [cors] enabled. I would like to enable cors for the endpoint:
/login/oauth/access_token.

How can I enable gitea in the config file app.ini to set the header:

    add_header 'Access-Control-Allow-Origin' '*';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

[zeripath]

Hmm

I think we might need a block like

gitea/routers/api/v1/api.go

Lines 556 to 563 in a3cc842

	m.Use(cors.Handler(cors.Options{
	//Scheme: setting.CORSConfig.Scheme, // FIXME: the cors middleware needs scheme option
	AllowedOrigins: setting.CORSConfig.AllowDomain,
	//setting.CORSConfig.AllowSubdomain // FIXME: the cors middleware needs allowSubdomain option
	AllowedMethods: setting.CORSConfig.Methods,
	AllowCredentials: setting.CORSConfig.AllowCredentials,
	MaxAge: int(setting.CORSConfig.MaxAge.Seconds()),
	}))

For those Auth routes

gitea/routers/routes/web.go

Lines 385 to 391 in 73a093d

	m.Group("/login/oauth", func() {
	m.Get("/authorize", bindIgnErr(auth.AuthorizationForm{}), user.AuthorizeOAuth)
	m.Post("/grant", bindIgnErr(auth.GrantApplicationForm{}), user.GrantApplicationOAuth)
	// TODO manage redirection
	m.Post("/authorize", bindIgnErr(auth.AuthorizationForm{}), user.AuthorizeOAuth)
	}, ignSignInAndCsrf, reqSignIn)
	m.Post("/login/oauth/access_token", bindIgnErr(auth.AccessTokenForm{}), ignSignInAndCsrf, user.AccessTokenOAuth)

It will need a little bit of thought to know which need it.

[zeripath]

@esfraner @sebastianwindeck Would you be able to try #14850 to see if that fixes your issue?