From dab1267e901156f5212122b7b19dc586bf38d3d0 Mon Sep 17 00:00:00 2001
From: poprhythm <james.kolpack@gmail.com>
Date: Sat, 28 Feb 2026 23:33:12 +0000
Subject: [PATCH] Add CORS config to Authelia OIDC for browser-based PKCE
 clients

---
 authelia/config/configuration.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/authelia/config/configuration.yaml b/authelia/config/configuration.yaml
index 8e003d8..d5c8c41 100644
--- a/authelia/config/configuration.yaml
+++ b/authelia/config/configuration.yaml
@@ -55,6 +55,14 @@ regulation:
 identity_providers:
   oidc:
     hmac_secret: ${AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET}
+    cors:
+      endpoints:
+        - authorization
+        - token
+        - revocation
+        - introspection
+        - userinfo
+      allowed_origins_from_client_redirect_uris: true
     jwks:
       - key_id: main
         algorithm: RS256