From c0cc05f0ddae4bfbb80788c9df2c7b7e19221d8c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Moritz=20J=C3=B6rg?= <moritz.jorg@oceanbox.io>
Date: Sat, 14 Mar 2026 17:39:15 +0100
Subject: [PATCH] fix(dex): CORS for *.oceanbox.io

---
 values/dex/values/values.yaml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/values/dex/values/values.yaml b/values/dex/values/values.yaml
index 01974f3a..2f96e992 100644
--- a/values/dex/values/values.yaml
+++ b/values/dex/values/values.yaml
@@ -157,10 +157,12 @@ ingress:
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
     nginx.ingress.kubernetes.io/backend-protocol: HTTP
     # CORS: allow browser-based OIDC flows (e.g. token introspection, JWKS fetch)
-    # cors-allow-credentials=true causes nginx-ingress to reflect $http_origin instead of "*"
-    # (browsers reject Access-Control-Allow-Origin: * when credentials are present)
-    # TODO: migrate to Gateway API HTTPRoute with ResponseHeaderModifier filter when cilium gateway supports it cluster-wide
+    # nginx-ingress treats non-"*" cors-allow-origin values as a regex pattern used in:
+    #   if ($http_origin ~* "PATTERN") { add_header 'Access-Control-Allow-Origin' $http_origin; }
+    # This is required because browsers reject Access-Control-Allow-Origin: * with credentialed requests.
+    # TODO: migrate to Gateway API HTTPRoute with ResponseHeaderModifier + cors policy filter when cilium gateway supports it cluster-wide
     nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/cors-allow-origin: "https://.*\\.oceanbox\\.io"
     nginx.ingress.kubernetes.io/cors-allow-credentials: "true"
     nginx.ingress.kubernetes.io/cors-allow-methods: "GET, POST, OPTIONS"
     nginx.ingress.kubernetes.io/cors-allow-headers: "Authorization, Content-Type"