Vfrdtyky

I am developing rest services and consuming those by ajax.

Now I have secured my web service with okta and it is working well when I invoke from chrome or any browser. But If I tried to consume from Jquery/ajax, I am getting below error. Could anyone Please help on this.

I have used python, flask to develop web services and used OpenIdConnect(flask_oidc) for authentication.
Piece of code

app = Flask(__name__)

app.config["OIDC_CLIENT_SECRETS"] = 

  services_dir+"okta/client_secrets.json"

app.config["OIDC_COOKIE_SECURE"] = False

app.config["OIDC_CALLBACK_ROUTE"] = "/oidc/callback"

app.config["OIDC_SCOPES"] = ["openid", "profile"]

app.config["SECRET_KEY"] = "********"

app.config['CORS_HEADERS'] = 'Content-Type'



oidc = OpenIDConnect(app)

cors = CORS(app, resources={r"/ai/*": {"origins": "*"}})





 @app.before_request

 def before_request():

     print("Before request",oidc.user_loggedin)

     if oidc.user_loggedin:

         #print("access token",oidc.get_access_token())

         print("sub",oidc.user_getinfo(["name"]))

         g.user = oidc.user_getfield("name")

     else:

         g.user = None  





@app.route('/ai/docsearchStatus', methods = ['GET'])

@cross_origin(origin='*')

@oidc.require_login

def getHealthstatus():

    response = {}

    response['user'] = g.user

    response=json.dumps(response); 

    return response

Jquery Ajax code:

$.ajax({     

        type:"GET",     

        url: "https://https://example.com/ai/docsearchStatus", 



        beforeSend: function(xhr) {

            xhr.setRequestHeader("Access-Control-Allow-Origin", "*");

            xhr.setRequestHeader("Accept", "application/json");

            xhr.setRequestHeader("Content-Type", "application/json");

        },

        success:function(data, textStatus, XMLHttpRequest){





        },     

        error:function(XMLHttpRequest, textStatus, errorThrown){ 

            //fnHideLoader();

            }               

    });

If I call https:///ai/docsearchStatus it is working properly(Redirecting--authenticating -- got response).
When I tried from ajax I am getting below URL:
Error is :

  Failed to load https://mycompany.okta.com/oauth2/ausl2cu6foKJx4WXS0x7/v1/authorize? Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘https://example.com’ is therefore not allowed access.

Can any one help this. I have even configured https://example.com in okta admin through API > Trusted Origins.

You need to define a Trusted Origin in Okta.

In your Okta Admin Console, browse to: Security -> API and choose the Trusted Origin tab.

You can then define a trusted origin for CORS.

Full disclosure: I work for Okta.