Kong / Kong/insomnia

Unable to login on web (https://app.insomnia.rest/app/authorize) with CORS issue

Open
#7,647 14 comments 0 reactions 0 assignees View on GitHub
B-bug S-unverified
Dominant language
TypeScript
Stars
40k
Forks
2.4k
Avg merge
2d 13h
Merged PRs (30d)
61

Description

### Expected Behavior

1. Pressed Login button on Insomnia Mac OS application (2023.2.2)
2. Chrome has been opened and redirected to https://app.insomnia.rest/app/authorize
3. Login via Google and succeeded
4. I have entered my correct passphrase, and it should be continued.

### Actual Behavior

If I enter my passphrase and continue,
1. 'Invalid passphrase, please try again' error is appearing.

It is the correct passphrase, and I did reset it several times

```
Access to fetch at 'https://api.insomnia.rest/auth/web-login-s' from origin 'https://app.insomnia.rest' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.
```

```
Failed to load resource: net::ERR_FAILED
```

And using [CORS extensions](https://chromewebstore.google.com/detail/cors-unblock/lfhmikememgdcahcdlaciloancbhjino) doesn't work.

### Reproduction Steps

You can see expected behavior

### Is there an existing issue for this?

- [X] I have searched the [issue tracker](https://www.github.com/Kong/insomnia/issues) for this problem.

### Additional Information

_No response_

### Insomnia Version

2023.2.2

### What operating system are you using?

macOS

### Operating System Version

13.2.1 (22D68)

### Installation method

download from insomnia.rest

### Last Known Working Insomnia version

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the login flow at https://app.insomnia.rest/app/authorize and inspect the request to https://api.insomnia.rest/auth/web-login-s in Chrome. Verify the CORS response when credentials are included and confirm that a correct passphrase completes login instead of showing the invalid-passphrase error.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, authentication, web-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.