Premium App OAuth Client creation fails due to CORS blocking final PATCH request

Hello Genesys Cloud Team! My name is Haris and I'm a developer for an up and coming project called Arkis. Recently we've been working on integrating our app with the App Foundry. For those purposes, we've been using the Premium App Example as our starter template. We're fairly close to achieving everything we need, however, besides creating an OAuth client for our API to interact with Genesys Cloud using client credentials, we're also trying to create one more OAuth client with code authorization to enable the users to automatically log in to our platform since we also provide OAuth login using Genesys Cloud. The logic for this implementation exists and seems to be functioning, however, the request gets blocked by CORS when trying to complete the installation. All steps get executed and the installation "fails" on the following part of the code (found in wizard/scripts/modules/app-instance.js):

        promisesArr.push(
        integrationsApi.putIntegrationConfigCurrent(
            appInstance.id, 
            integrationConfig
        )
        .then((data) => {
            logFunc('Configured instance: ' + appInstance.name);   

            let opts = {
                body: {
                    intendedState: 'ENABLED'
                }
            };
            
            return integrationsApi.patchIntegration(appInstance.id, opts)
        })
        .then((data) => logFunc('Enabled instance: ' + data.name))
        .catch((err) => console.error(err))
    );

The failure happens due to CORS blocking the PATCH request. I've tried using a Chrome plugin to try avoiding CORS blocking all requests but it seems to be failing on PATCH requests only. The config I've added in the 'oauth-client' object array looks like this:

            {
             "name":`GC OAuth - Arkis`,
            "description":"OAuth for Arkis Provider, generated automatically to provide login",
            "authorizedGrantType":"CODE",
            "registeredRedirectUri":[
                "http://localhost:8080/oauth-callback/purecloud",
                "http://localhost:8080/oauth-connect-callback/purecloud",
                "http://localhost:8080/premium-app-sample/index.html",
                "http://localhost:8080/wizard/index.html",
                "http://localhost:8080/wizard/supervisor.html",
                "http://localhost:8080/index.html",
                "http://localhost:8080/supervisor.html",
                "http://localhost:8081/oauth-callback/purecloud",
                "http://localhost:8081/oauth-connect-callback/purecloud",
                "https://mypurecloud.github.io/purecloud-premium-app/premium-app-sample/index.html",
                "https://mypurecloud.github.io/purecloud-premium-app/wizard/index.html",
                "https://mypurecloud.github.io/purecloud-premium-app/wizard/supervisor.html"
            ],
            "scope":[
                "alerting",
                "alerting:readonly",
                "analytics",
                "analytics:readonly",
                "architect",
                "architect:readonly",
                "assistants",
                "assistants:readonly",
                "audits:readonly",
                "authorization",
                "authorization:readonly",
                "billing:readonly",
                "coaching",
                "coaching:readonly",
                "content-management",
                "content-management:readonly",
                "conversations",
                "conversations:readonly",
                "devices",
                "devices:readonly",
                "dialog",
                "dialog:readonly",
                "external-contacts",
                "external-contacts:readonly",
                "fax",
                "fax:readonly",
                "gdpr",
                "gdpr:readonly",
                "geolocation",
                "geolocation:readonly",
                "greetings",
                "greetings:readonly",
                "groups",
                "groups:readonly",
                "identity-providers:readonly",
                "integrations",
                "integrations:readonly",
                "journey",
                "journey:readonly",
                "knowledge",
                "knowledge:readonly",
                "language-understanding",
                "language-understanding:readonly",
                "learning",
                "learning:readonly",
                "license",
                "license:readonly",
                "locations",
                "locations:readonly",
                "messaging",
                "messaging-platform",
                "messaging-platform:readonly",
                "messaging:readonly",
                "notifications",
                "oauth",
                "oauth:readonly",
                "organization",
                "organization-authorization",
                "organization-authorization:readonly",
                "organization:readonly",
                "outbound",
                "outbound:readonly",
                "presence",
                "presence:readonly",
                "quality",
                "quality:readonly",
                "recordings",
                "recordings:readonly",
                "response-management",
                "response-management:readonly",
                "routing",
                "routing:readonly",
                "scim",
                "scim:readonly",
                "scripts",
                "scripts:readonly",
                "search:readonly",
                "speech-and-text-analytics",
                "speech-and-text-analytics:readonly",
                "stations",
                "stations:readonly",
                "streaming-events:readonly",
                "telephony",
                "telephony:readonly",
                "textbots",
                "textbots:readonly",
                "upload",
                "user-basic-info",
                "user-recordings",
                "user-recordings:readonly",
                "users",
                "users:readonly",
                "voicemail",
                "voicemail:readonly",
                "web-chat",
                "web-chat:readonly",
                "widgets",
                "widgets:readonly",
                "workforce-management",
                "workforce-management:readonly"
            ],
            "finally": function(installedData, sendEmailToPureCloud){
                return new Promise((resolve, reject) => {
                    let protocol = 'http://';
                    return $.ajax({
                        url: `${protocol}localhost:8000/api/customers/genesys-client-update/`,
                        type: 'post',
                        data: JSON.stringify({
                            "client_id": installedData.id,
                            "secret": installedData.secret,
                            "base_path": localStorage.getItem("genesysBasePath"),
                            "key": localStorage.getItem("key"),
                            "is_social_app_update": true,
                            ...JSON.parse(localStorage.getItem("data_source_properties"))
                        }),
                        headers: {
                            'Accept': 'application/json',
                            'Content-Type': 'application/json'
                        }
                    }).done(() => {
                        console.log('Successfully installed');
                    }).fail(e => {
                        window.location.href = './uninstall.html?failed=true'
                        sendEmailToPureCloud("PureCloud signup process failed",
                          `PureCloud signup process failed at step 'oauth client' with error:\n${JSON.stringify(e)}`);
                        console.error(e);
                    }).always(() => {
                        resolve();
                    })
                });
            }
        }

Any help would be appreciated. Thank you in advance!

CORS headers are applied to requests based on the request's origin matching the host of a configured redirect URI for the OAuth client used when obtaining an access token. If the origin does not match a redirect URI, CORS headers will not be applied to the response. Additionally, please note that responses to requests using an access token obtained via client credentials will never have CORS headers on the response. You must never use client credentials in a browser context; a browser is not capable of handling client credentials securely. i.e. your web app will expose the client secret to your users resulting in your org being compromised.

If CORS is working for some requests but not others using the same access token, please open a case with Genesys Cloud Care to investigate.

This topic was automatically closed 31 days after the last reply. New replies are no longer allowed.