<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Yes we should have mentioned that in the discovery spec. That and the JWKS file for the keys.<div class=""><br class=""></div><div class="">John B.<br class=""><div><blockquote type="cite" class=""><div class="">On Jun 23, 2015, at 2:57 PM, Cal Heldenbrand <<a href="mailto:cal@fbsdata.com" class="">cal@fbsdata.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="">Hi everyone,<br class=""><br class=""></div>I noticed when reading through the OIDC core spec, <a href="http://openid.net/specs/openid-connect-standard-1_0-21.html#userinfo" class="">Section 4</a> has a blurb recommending CORS header support: <br class=""><br clear="all" class=""><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote">The UserInfo Endpoint SHOULD support the use of Cross Origin Resource Sharing (CORS) [CORS] and or other methods as appropriate to enable Java Script Clients to access the endpoint.<a name="UserInfoRequest" class=""></a></blockquote><div class=""><div class=""><div class=""><div class="gmail_signature"><br class=""></div><div class="gmail_signature">But when I look through the <a href="https://openid.net/specs/openid-connect-discovery-1_0.html" class="">Discovery document</a>, there are no mentions of CORS support. If an OP advertises the implicit flow in the metadata, shouldn't CORS support be a requirement in the specification? Otherwise a js client will choke on an AJAX discovery request, and the whole process is busted unless the developer manually specifies the endpoints.<br class=""><br class=""></div><div class="gmail_signature">I ran into this when testing the Implicit flow against Google's discovery endpoint, and started down the rabbit hole of reading. ;-)<br class=""><br class=""></div><div class="gmail_signature">Thank you!<br class=""><br class=""></div><div class="gmail_signature">--Cal<br class=""><br class=""></div><div class="gmail_signature">---------------------------------------------------------------<br class="">Cal Heldenbrand<br class=""> Web Operations at FBS<br class=""> Creators of <a href="http://flexmls.com/" target="_blank" class="">flexmls</a>® and <a href="http://sparkplatform.com/" target="_blank" class="">Spark Platform</a><br class=""> <a href="mailto:cal@fbsdata.com" target="_blank" class="">cal@fbsdata.com</a></div></div>
</div></div></div>
_______________________________________________<br class="">general mailing list<br class=""><a href="mailto:general@lists.openid.net" class="">general@lists.openid.net</a><br class="">http://lists.openid.net/mailman/listinfo/openid-general<br class=""></div></blockquote></div><br class=""></div></body></html>