The Shibboleth IdP V4 software will leave support on September 1, 2024.

CORS handling

CSome relying parties may do CORS (Cross-Origin Resource Sharing) pre-flight requests towards the IdP. This page discuss some alternatives for handling that.

Java Servlet Container

At least Jetty and Tomcat have their own Filter implementations for handling CORS requests:

Spring CORS Configuration

IdP V4.2 provides a native/proprietary mechanism for supporting this via Spring. A global bean called shibboleth.CorsConfigurations may contain a map of org.springframework.web.cors.CorsConfiguration declarations, where the key of each entry corresponds to the locations under the <context>/profile URL tree (e.g., /oidc/token correponds with

By default, the map is not defined and thus Spring doesn’t provide any CORS handling.

The following example contains an example that activates the Spring CORS handling for the OP plugin’s token -endpoint:

<util:map id="shibboleth.CorsConfigurations" value-type="org.springframework.web.cors.CorsConfiguration"> <entry key="/oidc/token"> <bean class="org.springframework.web.cors.CorsConfiguration" p:allowedOrigins="http://localhost:8080,http://localhost:8081" p:allowedMethods="POST" p:allowedHeaders="Authorization" p:maxAge="1800" /> </entry> </util:map>

This enables the CORS pre-flight request handling from two example origins, when the HTTP request header Access-Control-Request-Method is set to POST.