From be059500aacd5d05ef2b6115c9d3018f9488bd33 Mon Sep 17 00:00:00 2001 From: Zeeshan Mehboob Date: Fri, 12 Jun 2026 01:11:45 +0530 Subject: [PATCH 1/2] [MODIFIED] nginx conf for cors issue in wellknown Signed-off-by: Zeeshan Mehboob --- docker-compose/nginx.conf | 50 +++++++++++++++++++++++++++ helm/oidc-ui/templates/configmap.yaml | 18 ++++++++++ oidc-ui/nginx/nginx.conf | 30 ++++++++++++++++ 3 files changed, 98 insertions(+) diff --git a/docker-compose/nginx.conf b/docker-compose/nginx.conf index 39ecdbad7..30a10e764 100644 --- a/docker-compose/nginx.conf +++ b/docker-compose/nginx.conf @@ -7,6 +7,12 @@ events { http { access_log /var/log/nginx/access.log; error_log /var/log/nginx/error.log; + + map $http_origin $cors_allowed_origin { + default ""; + "~^https?://([a-z0-9-]+\.)?mosip\.net$" $http_origin; # Matches *.mosip.net + } + server { listen 3000; server_name localhost; @@ -27,6 +33,8 @@ http { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Host $server_name; + add_header Content-Security-Policy "default-src 'none'" always; + add_header Referrer-Policy "no-referrer" always; } location /.well-known/openid-configuration { proxy_pass http://esignet:8088/v1/esignet/oidc/.well-known/openid-configuration; @@ -35,6 +43,14 @@ http { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Host $server_name; + add_header Content-Security-Policy "default-src 'none'" always; + add_header Referrer-Policy "no-referrer" always; + add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; + types { + text/plain log cer json txt; + } } location /.well-known/jwks.json { proxy_pass http://esignet:8088/v1/esignet/oauth/.well-known/jwks.json; @@ -43,6 +59,14 @@ http { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Host $server_name; + add_header Content-Security-Policy "default-src 'none'" always; + add_header Referrer-Policy "no-referrer" always; + add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; + types { + text/plain log cer json txt; + } } location /.well-known/oauth-authorization-server { proxy_pass http://esignet:8088/v1/esignet/oauth/.well-known/oauth-authorization-server; @@ -51,6 +75,14 @@ http { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Host $server_name; + add_header Content-Security-Policy "default-src 'none'" always; + add_header Referrer-Policy "no-referrer" always; + add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; + types { + text/plain log cer json txt; + } } location /.well-known/openid-credential-issuer { proxy_pass http://esignet:8088/v1/esignet/vci/.well-known/openid-credential-issuer; @@ -59,6 +91,14 @@ http { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Host $server_name; + add_header Content-Security-Policy "default-src 'none'" always; + add_header Referrer-Policy "no-referrer" always; + add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; + types { + text/plain log cer json txt; + } } # location /oidc-ui { # alias /usr/share/nginx/oidc-ui; @@ -67,6 +107,16 @@ http { location / { # alias /usr/share/nginx/html; try_files $uri $uri/ /index.html; + add_header Content-Security-Policy " + default-src 'self'; + style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; + font-src 'self' https://fonts.gstatic.com; + img-src 'self' data: https://cdn.jsdelivr.net https://*.mosip.net; + script-src 'self' https://www.google.com https://www.gstatic.com; + frame-src https://www.google.com; + connect-src 'self' http://127.0.0.1:*; + " always; + add_header Referrer-Policy "no-referrer" always; } } } \ No newline at end of file diff --git a/helm/oidc-ui/templates/configmap.yaml b/helm/oidc-ui/templates/configmap.yaml index f2b3891cf..004c4b101 100644 --- a/helm/oidc-ui/templates/configmap.yaml +++ b/helm/oidc-ui/templates/configmap.yaml @@ -21,6 +21,12 @@ data: http { access_log /var/log/nginx/access1.log; error_log /var/log/nginx/error1.log; + + map $http_origin $cors_allowed_origin { + default ""; + "~^https?://([a-z0-9-]+\.)?mosip\.net$" $http_origin; # Matches *.mosip.net + } + server { listen {{ .Values.oidc_ui.oidc_ui_port }}; server_name localhost; @@ -54,6 +60,9 @@ data: proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; + add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; types { text/plain log cer json txt; } @@ -68,6 +77,9 @@ data: proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; + add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; types { text/plain log cer json txt; } @@ -82,6 +94,9 @@ data: proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; + add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; types { text/plain log cer json txt; } @@ -96,6 +111,9 @@ data: proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; + add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; types { text/plain log cer json txt; } diff --git a/oidc-ui/nginx/nginx.conf b/oidc-ui/nginx/nginx.conf index b4d2cfa7c..029847d45 100644 --- a/oidc-ui/nginx/nginx.conf +++ b/oidc-ui/nginx/nginx.conf @@ -7,6 +7,12 @@ events { http { access_log /var/log/nginx/access.log; error_log /var/log/nginx/error.log; + + map $http_origin $cors_allowed_origin { + default ""; + "~^https?://([a-z0-9-]+\.)?mosip\.net$" $http_origin; # Matches *.mosip.net + } + server { listen 3000; server_name localhost; @@ -40,6 +46,12 @@ http { proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; + add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; + types { + text/plain log cer json txt; + } } location /.well-known/jwks.json { proxy_pass http://esignet.esignet/v1/esignet/oauth/.well-known/jwks.json; @@ -50,6 +62,12 @@ http { proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; + add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; + types { + text/plain log cer json txt; + } } location /.well-known/oauth-authorization-server { proxy_pass http://esignet.esignet/v1/esignet/oauth/.well-known/oauth-authorization-server; @@ -60,6 +78,12 @@ http { proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; + add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; + types { + text/plain log cer json txt; + } } location /.well-known/openid-credential-issuer { proxy_pass http://esignet.esignet/v1/esignet/vci/.well-known/openid-credential-issuer; @@ -70,6 +94,12 @@ http { proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; + add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; + types { + text/plain log cer json txt; + } } # location /oidc-ui { # alias /usr/share/nginx/oidc-ui; From 8c5874821e3933968e3efc59b2efd80dfd3f15c0 Mon Sep 17 00:00:00 2001 From: Zeeshan Mehboob Date: Fri, 12 Jun 2026 12:37:11 +0530 Subject: [PATCH 2/2] [MODIFIED] nginx conf for cors issue in wellknown Signed-off-by: Zeeshan Mehboob --- docker-compose/nginx.conf | 13 ++++--------- helm/oidc-ui/templates/configmap.yaml | 13 ++++--------- oidc-ui/nginx/nginx.conf | 13 ++++--------- 3 files changed, 12 insertions(+), 27 deletions(-) diff --git a/docker-compose/nginx.conf b/docker-compose/nginx.conf index 30a10e764..c6dae2f41 100644 --- a/docker-compose/nginx.conf +++ b/docker-compose/nginx.conf @@ -8,11 +8,6 @@ http { access_log /var/log/nginx/access.log; error_log /var/log/nginx/error.log; - map $http_origin $cors_allowed_origin { - default ""; - "~^https?://([a-z0-9-]+\.)?mosip\.net$" $http_origin; # Matches *.mosip.net - } - server { listen 3000; server_name localhost; @@ -45,7 +40,7 @@ http { proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; - add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Origin' '*' always; add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; types { @@ -61,7 +56,7 @@ http { proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; - add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Origin' '*' always; add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; types { @@ -77,7 +72,7 @@ http { proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; - add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Origin' '*' always; add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; types { @@ -93,7 +88,7 @@ http { proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; - add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Origin' '*' always; add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; types { diff --git a/helm/oidc-ui/templates/configmap.yaml b/helm/oidc-ui/templates/configmap.yaml index 004c4b101..e95d7f707 100644 --- a/helm/oidc-ui/templates/configmap.yaml +++ b/helm/oidc-ui/templates/configmap.yaml @@ -22,11 +22,6 @@ data: access_log /var/log/nginx/access1.log; error_log /var/log/nginx/error1.log; - map $http_origin $cors_allowed_origin { - default ""; - "~^https?://([a-z0-9-]+\.)?mosip\.net$" $http_origin; # Matches *.mosip.net - } - server { listen {{ .Values.oidc_ui.oidc_ui_port }}; server_name localhost; @@ -60,7 +55,7 @@ data: proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; - add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Origin' '*' always; add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; types { @@ -77,7 +72,7 @@ data: proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; - add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Origin' '*' always; add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; types { @@ -94,7 +89,7 @@ data: proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; - add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Origin' '*' always; add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; types { @@ -111,7 +106,7 @@ data: proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; - add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Origin' '*' always; add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; types { diff --git a/oidc-ui/nginx/nginx.conf b/oidc-ui/nginx/nginx.conf index 029847d45..a874a89bf 100644 --- a/oidc-ui/nginx/nginx.conf +++ b/oidc-ui/nginx/nginx.conf @@ -8,11 +8,6 @@ http { access_log /var/log/nginx/access.log; error_log /var/log/nginx/error.log; - map $http_origin $cors_allowed_origin { - default ""; - "~^https?://([a-z0-9-]+\.)?mosip\.net$" $http_origin; # Matches *.mosip.net - } - server { listen 3000; server_name localhost; @@ -46,7 +41,7 @@ http { proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; - add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Origin' '*' always; add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; types { @@ -62,7 +57,7 @@ http { proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; - add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Origin' '*' always; add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; types { @@ -78,7 +73,7 @@ http { proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; - add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Origin' '*' always; add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; types { @@ -94,7 +89,7 @@ http { proxy_set_header X-Forwarded-Host $server_name; add_header Content-Security-Policy "default-src 'none'" always; add_header Referrer-Policy "no-referrer" always; - add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always; + add_header 'Access-Control-Allow-Origin' '*' always; add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always; types {