Skip to content

[OAuth] CORS Handling - OPTIONS request return 404

Gitlab is returning 404 for an OPTIONS request on OAuth endpoints.

$ curl -i -XOPTIONS https://gitlab.com/oauth/token
HTTP/1.1 404 Not Found
Server: nginx
Date: Wed, 23 Sep 2015 16:11:43 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 448
Status: 404 Not Found
X-Request-Id: 4a9cd205-83bd-454b-85d4-6c7d3a2d2605
X-Runtime: 0.003531

This prevent to retrieve an access_token from an JS app application (e.g. AngularJS).

Furthermore, no CORS are returned, but this could be hacked by an ugly headers set in reverse proxy configuration.

A quick fix could be to allow OPTIONS requests on these endpoints.

Gitlab Version: GitLab 8.0.0 d70c051d