Abort login flow if CORS error is encountered

[dchiquito]

If CORS is misconfigured on the server, the authorization flow can still succeed. However, when maybeRestoreLogin is called, it performs an XHR call to get a token from the API server, which fails because of CORS. This error is interpreted as meaning that the user is not authenticated, so the browser is redirected to the start of the OAuth flow again, creating an infinite loop.

It would be nice if the OAuth client could distinguish between a 401 and a CORS error and abort the login flow with an informative error if a CORS error is encountered.

attn @zachmullen

[zachmullen]

It's possible I'm misunderstanding, but I think this might have to be addressed downstream, because the XHRs that trigger the CORS error are not happening inside this library, but in the downstream one.

[zachmullen]

On further digging, I think my last comment was wrong. This code is silently eating CORS errors; we should probably handle that differently.

[brianhelba]

Good point, we should try harder to distinguish different causes of failure in that code.