JavaScriptClients in WebApiSecurity error 'is not allowed by Access-Control-Allow-Origin.' about identityserver2

[leastprivilege]

CORS is currently not implemented. In one of the next builds though...

[vip32]

i investigated the problem some more and it seems its happening client-side. the request doesn't even hit the server. i'm running the client from localhost (iisexpress). maybe that has something to do with the cors negotiation (not there).

[brockallen]

This will require more configuration as well.

[leastprivilege]

Yes, that's CORS. As I said this is not supported right now

[brockallen]

I think we're eventually going to allow the OAuth implicit flow thus there's no need to allow CORS access to the OAuth token endpoint. If you really want this support then you can add the CORS configuration yourself with little effort. Here's a post on how to get started with that: http://brockallen.com/2012/06/28/cors-support-in-webapi-mvc-and-iis-with-thinktecture-identitymodel/

[vip32]

when will this implicit flow be available, any ideas?

[leastprivilege]

It is available in the current bits.

[vip32]

correct, i made some implicit flow requests and it's working :) i also got CORS working (thanks Brock) in the idsrv, but implicit flow is much easier.

the only grant_type not working is 'client_credentials' (unsupported), but i can use 'passwords' for now.