title: LinkedIn OAuth redirect login returning "No 'Access-Control-Allow-Origin' header is present on the requested resource" error
body: <p>I'm currently implementing OAuth login with LinkedIn in my React and Play app and am running into a CORS error when trying to redirect to the authorization page in my dev environment:</p>
  
  <p><code>XMLHttpRequest cannot load https://www.linkedin.com/oauth/v2/authorization?response_type=code&amp;client_i…basicprofile&amp;redirect_uri=http%3A%2F%2Flocalhost%3A9000%2Fusers%2Flinkedin. Redirect from 'https://www.linkedin.com/oauth/v2/authorization?response_type=code&amp;client_i…basicprofile&amp;redirect_uri=http%3A%2F%2Flocalhost%3A9000%2Fusers%2Flinkedin' to 'https://www.linkedin.com/uas/login?session_redirect=%2Foauth%2Fv2%2Flogin-s…' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access.</code></p>
  
  <p>I have the following setup:</p>
  
  <ul>
  <li>Play server running at localhost:9000</li>
  <li>React app (created via create-react-app) running at localhost:3000</li>
  </ul>
  
  <p>My JS code calls the <code>/auth/linkedin</code> endpoint which is implemented as follows:</p>
  
  <pre><code>Action { implicit req: RequestHeader =&gt;
    val csrfToken = CSRF.getToken.get.value
    Redirect(linkedinUrl(oauthConfig.linkedinClientId, csrfToken)).withSession("state" -&gt; csrfToken)
  }
  </code></pre>
  
  <p>I have my Play application set to handle CORS appropriately.</p>
  
  <p>My react app just makes a request to the above endpoint via Axios:</p>
  
  <p><code>axios.get('/auth/linkedin')</code></p>
  
  <p>This responds with a 303 with a redirect to the LinkedIn auth page which then gives me the error.</p>
  
  <p>How do I get the CORS policy working correctly in this dev setup?  I've tried adding the following to my package.json as the create-react-app documentation recommends:</p>
  
  <p><code>"proxy": "http://localhost:9000",</code></p>
  
  <p>And I've also tried setting a request header to <code>"Access-Control-Allow-Origin" : "*"</code> on the redirect in the Play server with no success.</p>
  
  <p>Note that going to localhost:9000/auth/linkedin redirects properly.</p>