CORS errors when entering directly MFE host through the browser and not by redirections

[mariajgrimaldi]

Description

When opening the https://apps.redwood.demo.edly.io/course-authoring/home directly w/o opening the https://studio.redwood.demo.edly.io and then being redirected, a CORS error is raised when trying to use the MFE. In this case the MFE doing the request for oauth2 to login into the studio and failed because of CORS. When I'm opening the Studio MFE from studio.redwood.demo.edly.io I became a logged in user and the login flow from MFE is not triggered.

Expected behavior

Request to became a Course creator is sent, an appropriate message is displayed

Actual behavior

I get an error Sorry, there was error with you request.
Console logs:

home:1 Access to XMLHttpRequest at 'https://redwood.demo.edly.io/oauth2/authorize?client_id=cms-sso&redirect_uri=https%3A%2F%2Fstudio.redwood.demo.edly.io%2Fcomplete%2Fedx-oauth2%2F%3Fredirect_state%3DnWpdAjq4Qqrjji7z9koTja6UvhjoviKz&state=nWpdAjq4Qqrjji7z9koTja6UvhjoviKz&response_type=code&scope=user_id+profile+email' (redirected from 'https://studio.redwood.demo.edly.io/request_course_creator') from origin 'https://apps.redwood.demo.edly.io' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' 
header is present on the requested resource.

Steps to reproduce

1. Register a new User
2. Open Studio https://apps.redwood.demo.edly.io/course-authoring/home
3. Click on Becoming a course creator in Studio area below the text Are you staff on an existing Studio course? The course creator must give you access to the course. Contact the course creator or administrator for the course you are helping to author.
4. Click on Request the abillity to create courses button.

Original issue: openedx/wg-build-test-release#379

[mariajgrimaldi]

I'm not sure if this is the intended behavior, so I opened this issue to make sure. Feel free to close it if it's a non-issue.

[mariajgrimaldi]

I tested something similar in the learning MFE: I tried loading apps... instead of LMS host, then I tried to unenroll but didn't get any cors issue.

[crathbun428]

@mariajgrimaldi - This is an interesting one. Thank you for reporting. It feels weird to allow someone that currently doesn't have access to Studio to make a request to get access to Studio and have the error message be: Sorry, there was an error with your request with little detail. Is this button being used somewhere on the backend? @jmakowski1123 or @sarina

As an alternative, I could see this being updated with a message letting the user know that they currently don't have permissions to access studio and let them know if they should have access, they should reach out to their course delivery team to be added to the appropriate course(s) as staff.

[sarina]

I think this is the same as the Limited Staff User issue: if we detect there are permissions errors in accessing a Studio page, you should get a message along the lines of "You don't have access to this page, if this is in error, please contact your site admin" or something.

[crathbun428]

@sarina - Thanks, Sarina. This makes sense to me.

FYI - Maria, I'll update this bug's priority level.

[mariajgrimaldi]

Comments copied from #379: [Test failure] <TC_AUTHOR_146>: Can't request a Course creator role in Studio

Originally posted by @mariajgrimaldi on 2024-06-06T03:08:52Z

Thanks for the report! I followed the instructions to reproduce the issue but couldn't.

Screencast.from.05-06-24.23.12.51.webm

Could you try again, please?

---

Originally posted by @cmltaWt0 on 2024-06-06T08:42:12Z

It doesn't work for me yet.

Screen.Recording.2024-06-06.at.11.41.19.mov

But it works for our QA...

---

Originally posted by @cmltaWt0 on 2024-06-06T12:44:26Z

@mariajgrimaldi We've found the root-cause! (thanks @dyudyunov !)
I'm opening the https://apps.redwood.demo.edly.io/course-authoring/home directly w/o opening the https://studio.redwood.demo.edly.io in the first place.
In this case the MFE doing the request for oauth2 to login into the studio and failed because of CORS.
When I'm opening the Studio MFE from studio.redwood.demo.edly.io I became a logged in user and the login flow from MFE is not triggered.

---

Originally posted by @mariajgrimaldi on 2024-06-10T16:14:32Z

@cmltaWt0 @dyudyunov: thank you both for the insight! I'm not sure if this is the intended behavior, so I opened an issue in the Course Authoring MFE to alert maintainers.

---

Originally posted by @cmltaWt0 on 2025-05-12T13:33:23Z

Just for testing - I've reproduced the issue on https://teak.demo.edly.io

---

[samuelallan72]

CC @mariajgrimaldi @sarina @kaustavb12

We're investigating an issue which appears to be the same issue as this. We discovered that CORS isn't the problem here. The real problem is that certain api requests made by the Authoring app are to CMS endpoints that require the CMS login (studio_session_id cookie).

The issue can be reliably reproduced by the following steps:

1. Copy or bookmark a direct url to a course outline in Authoring.
2. Log out of the LMS, and log back in. Do not visit Studio / CMS. (This results in you being logged in to the LMS, but not directly logged into the CMS; this CMS login only happens on first visit to a CMS web page where you are redirected through the lms oauth process)
3. Directly navigate to the Authoring url from step 1.
4. Try to perform one of the following actions: click the "New unit" button, click the "New subsection" button, click the "New section" button.

These actions will fail, and you will see an error message at the top of the page "Unable to save changes. Please try again.". In the network requests console, you will see a request to the CMS /xblock/ API. Since the CMS is not logged in yet, this will attempt to redirect through the LMS oauth login - you will see a redirection path like (cms) /xblock/ -> (cms) /login/ -> (cms) -> /login/edx-oauth2/ -> (lms) /oauth2/authorize [which fails with the CORS error].

Screenshots

This login flow is not supposed to work over xhr requests. Also note that these requests still don't work if the CORS issue is overcome, because the original POST request and params to /xblock/ are lost in the redirect sequence.

---

Note: we haven't yet investigated the case where the user loads authoring, but doesn't actually have permission to access the Studio content. The scope here is for users who do have permission, but find themselves in the above situation.

We're interested in feedback on ideas for fixing this. We're currently investigating a method that will be similar in implementation to what the frontend-platform code does when requireAuthenticatedUser: true is set: check if the user is logged in, and if not, redirect to the login page. We have a proof of concept in progress at #2335

An alternative route to fixing this may be to patch the CMS APIs to accept the JWT based authentication that should be valid for both the LMS and the CMS. This route was taken for a similar (albeit smaller scoped) issue: #1434 (and the fix: openedx/edx-platform#35765 ).

Internal OpenCraft ticket for reference: BB-9549

[sarina]

We're currently investigating a method that will be similar in implementation to what the frontend-platform code does when requireAuthenticatedUser: true is set: check if the user is logged in, and if not, redirect to the login page. We have a proof of concept in progress at #2335

I think @arbrandes or @bradenmacdonald should give feedback on this approach, I'm happy to take on any product-related questions in this area while Chelsea is out but am not qualified to comment on this level of technical approach 😅