[Unity-idm-discuss] unity and SPA using PKCE

[Sander A. <sa....@fz...>]

Good morning Krzysztof,
we have an SP which operates a single page application (SPA) and want
to use PKCE. The browser expect HTTP header "access-control-allow-
origin" to CORS requests, but it seems that unity does not send them:

HTTP/1.1 200 OK
Date: Wed, 03 Nov 2021 08:04:10 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Frame-Options: DENY
Allow: POST,GET,OPTIONS,HEAD
Content-Length: 0

After switching the client type to public, because this is the only
section in documentation where PKCE is mentioned the header looks like
this:

Endpoint:
https://login-dev.helmholtz.de/oauth2/token

OPTIONS /oauth2/token HTTP/1.1
Host: login-dev.helmholtz.de
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
Firefox/91.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Referer: https://rz-vm64.gfz-potsdam.de:3000/
Origin: https://rz-vm64.gfz-potsdam.de:3000
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

Is PKCE already fully supported in unity? Do we need to do some further
configuration to allow PKCE for this client?

Best regards,
Sander
-- 
Federated Systems and Data
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

-----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Volker Rieke
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht,
Prof. Dr. Frauke Melchior
-----------------------------------------------------------------------
-----------------------------------------------------------------------