Casbin Forum runs on Casnode, the open-source Discourse-style forum. Try the Casnode demo →
Casbin Forum
AllTopicsRepliesLikes
R
GET /api/get-user returns 403 with valid JWT access token due to CORS filterMay 2024
Casdoor

I finally resolved the issue. There was nothing wrong with the Casbin enforcer, but rather with the CORS filter in Casdoor. The CORS settings in Casdoor depend on the application's redirect URLs, but for some reason a valid redirect URL was receiving a 403 error in the GET /api/get-user endpoint. I dug into the codebase, but everything seemed fine. My solution was to write the redirect URL as a regex, which resolved the 403 error. This might interest you.

Update: When only containing the host part (e.g., https://example.com), everything works fine. However, if there is a path included in the redirect URL (even just a slash like https://example.com/), issues arise.

Casnode
This forum runs on Casnode, an open-source forum with the look and features of Discourse, built with Go and Next.js. See what it can do on the Casnode demo site.
Try the Casnode demo