CORS not working for custom domain

[bkr-bc]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

distracted-buck-lwl68daajh

Describe the bug

I enter https://my-dev.tradium.com as allowed cross origin for my custom domain.
I get the following console errors when trying to use it:
Firefox:
Quellübergreifende (Cross-Origin) Anfrage blockiert: Die Gleiche-Quelle-Regel verbietet das Lesen der externen Ressource auf https://dev-auth.tradium.com/.well-known/openid-configuration?client_id=77e0932c-6c2d-4961-9c10-878003a02aad. (Grund: CORS-Kopfzeile 'Access-Control-Allow-Origin' stimmt nicht mit 'https://my-dev.tradium.com,https://my-dev.tradium.com' überein).

Chrome:
Access to XMLHttpRequest at 'https://dev-auth.tradium.com/.well-known/openid-configuration?client_id=77e0932c-6c2d-4961-9c10-878003a02aad' from origin 'https://my-dev.tradium.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'https://my-dev.tradium.com,https://my-dev.tradium.com', but only one is allowed.

Reproducing the bug

See Description

Relevant log output

Firefox: 
Quellübergreifende (Cross-Origin) Anfrage blockiert: Die Gleiche-Quelle-Regel verbietet das Lesen der externen Ressource auf https://dev-auth.tradium.com/.well-known/openid-configuration?client_id=77e0932c-6c2d-4961-9c10-878003a02aad. (Grund: CORS-Kopfzeile 'Access-Control-Allow-Origin' stimmt nicht mit '[https://my-dev.tradium.com,https://my-dev.tradium.com](https://my-dev.tradium.com,https//my-dev.tradium.com)' überein).

Chrome:
Access to XMLHttpRequest at 'https://dev-auth.tradium.com/.well-known/openid-configuration?client_id=77e0932c-6c2d-4961-9c10-878003a02aad' from origin 'https://my-dev.tradium.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'https://my-dev.tradium.com,https://my-dev.tradium.com', but only one is allowed.

Relevant configuration

Version

Cloud

On which operating system are you observing this issue?

macOS

In which environment are you deploying?

Docker

Additional Context

No response

[jhickmanit]

Hello Bernhard,

Is it possible that you have added both the custom domain CORS configuration (https://www.ory.sh/docs/guides/custom-domains#cors) as well as the project wide CORS settings (https://www.ory.sh/docs/guides/cors)? You typically only need the custom domains setting for most use cases.

[bkr-bc]

Hi,
that might acutally be the case I will check that.