CORs Error on API Call to Auth0

[BarryCarlyon]

@ohadialex

  data: new URLSearchParams({
    grant_type: 'client_credentials',
    client_id: 'YOUR_CLIENT_ID',
    client_secret: 'YOUR_CLIENT_SECRET',
    audience: 'YOUR_API_IDENTIFIER'
  })

This leaks your Auth0 client secret to anyone using the extension…

@ohadialex

Request header field access-control-allow-origin is not allowed by Access-Control-Allow-Headers in preflight response.

The remote server has set a header which disallows the access-control-allow-origin header being used in calls made to it.

This isn’t a “Twitch/Extension Configuration” problem.

It’s Auth0 blocking this request as it includes a disallowed header, in this case access-control-allow-origin is the conflicting header.

This is likely done to prevent you trying to generate a client_credentials token and leaking your client secret to the world