Scenario #9820: The Auth Configuration Can Be Fetched From a Foreign Origin Before Any Login

A browser-frontend on another origin has to call GET /api/auth-config before any login, thus without any token (chicken-and-egg), so the endpoint has to answer the CORS-preflight and the actual request like the other public /api endpoints.

Answer the CORS-preflight from the foreign origin

HTTP OPTIONS "/api/auth-config" \
  -H 'Access-Control-Request-Method: GET' \
  -H 'Origin: https://frontend.example'
=> status: 200 OK 

Fetch the authentication configuration from the foreign origin

HTTP GET "/api/auth-config" \
  -H 'Origin: https://frontend.example'
=> status: 200 OK 
{
  "method" : "fake-jwt",
  "authority" : null,
  "tokenUrl" : "/fake-jwt/token"
}

---

generated on 2026-08-10 01:38:09 for branch