Allow CORS on discovery endpoint

server/handlers.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/gorilla/handlers"
 	"github.com/gorilla/mux"
 	jose "gopkg.in/square/go-jose.v2"
 
@@ -101,7 +102,7 @@ type discovery struct {
 	Claims        []string `json:"claims_supported"`
 }
 
-func (s *Server) discoveryHandler() (http.HandlerFunc, error) {
+func (s *Server) discoveryHandler() (http.Handler, error) {
 	d := discovery{
 		Issuer:      s.issuerURL.String(),
 		Auth:        s.absURL("/auth"),
@@ -127,11 +128,18 @@ func (s *Server) discoveryHandler() (http.HandlerFunc, error) {
 		return nil, fmt.Errorf("failed to marshal discovery data: %v", err)
 	}
 
-	return func(w http.ResponseWriter, r *http.Request) {
+	var discoveryHandler http.Handler
+	discoveryHandler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
 		w.Header().Set("Content-Length", strconv.Itoa(len(data)))
 		w.Write(data)
-	}, nil
+	})
+	if len(s.discoveryAllowedOrigins) > 0 {
+		corsOption := handlers.AllowedOrigins(s.discoveryAllowedOrigins)
+		discoveryHandler = handlers.CORS(corsOption)(discoveryHandler)
+	}
+
+	return discoveryHandler, nil
 }
 
 // handleAuthorization handles the OAuth2 auth endpoint.