title: CORS and the OAuth 2 authorization code flow
body: <p>I have a back end application that is protected with the OAuth 2 authorization code flow. The front end (javascript in browser) hits an authorization endpoint on the back end, the back end redirects the browser to an authorization code server, the user authenticates and then the authorization server redirects the browser back to the back end with an authorization code which the back end redeems for a token to access some services.</p>
  
  <p>The problem is that these redirects all happen in succession and CORS in the browser is preventing the exchange. What do the servers need to do as far as CORS to make this flow work?  </p>
  
  <pre><code>browser                                 -&gt; POST app.com/auth
  307 auth.com/auth?redirect=app.com/auth &lt;-
  browser                                 -&gt; POST auth.com/auth?redirect=app.com/auth (with authorization header)
  307 app.com/auth?authcode=fubar         &lt;-
  browser                                 -&gt; POST app.com/auth?authcode=fubar
  </code></pre>
  
  <p>Is roughly how it is supposed to go.</p>
  
  <p>EDIT:
  Browser says </p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load <a href="http://app.com/autho" rel="nofollow noreferrer">http://app.com/autho</a>. The
    request was redirected to
    '<a href="http://autho.com/auth?response_type=code&amp;redirect_uri=http://app.com/autho&amp;state=639bfbe7-fd20-4c04-8feb-c9f60f4d55a9&amp;client_id=0xdeadbeef" rel="nofollow noreferrer">http://autho.com/auth?response_type=code&amp;redirect_uri=http://app.com/autho&amp;state=639bfbe7-fd20-4c04-8feb-c9f60f4d55a9&amp;client_id=0xdeadbeef</a>',
    which is disallowed for cross-origin requests that require preflight.</p>
  </blockquote>
  
  <p>EDIT2: So the redirect works fine without the <code>Authorization</code> header. Guess that data is going in the body for now.</p>