Scenario #9830: The Frontend Logs in Directly At the Reported Fake Jwt Token Url

A browser-frontend on another origin logs in at the token-URL which GET /api/auth-config reported, without any proxy in between; therefore /fake-jwt/** has to answer CORS requests like the /api endpoints do.

Fetch the authentication configuration without any login

HTTP GET "/api/auth-config"
=> status: 200 OK 
{
  "method" : "fake-jwt",
  "authority" : null,
  "tokenUrl" : "/fake-jwt/token"
}

Answer the CORS-preflight for the token-URL from the foreign origin

HTTP OPTIONS "/fake-jwt/token" \
  -H 'Access-Control-Request-Method: POST' \
  -H 'Origin: https://frontend.example'
=> status: 200 OK 

Log in at the reported token-URL directly from the foreign origin

HTTP POST "/fake-jwt/token" \
  -H 'Origin: https://frontend.example' \
  <<EOF
username=frontend-developer&password=anything
EOF
=> status: 200 OK 

---

generated on 2026-08-10 03:08:49 for branch HEAD