Paul Greenberg

> I think it has to do with my Caddy configuration? As you can see, I basically pulled things out of my bum and have no idea what I'm doing....

@rubydotexe , for testing, please do the following: ``` auth.example.com { import tls_config # import options header Access-Control-Allow-Origin "*" header Access-Control-Allow-Methods "*" authenticate with myportal root * /usr/share/caddy file_server }...

> Here you go: @rubydotexe , do you still get `Cross-Origin Request Blocked`?

> The console errors are at least slightly different, but I'm still having to login at short intervals. @rubydotexe , please use Chrome and collect logs (HAR) from your session....

@LeonardMeyer , greenpau|outlook.com

> I'm not fond of using the wildcard so I'll try with more specific headers ([which seems not so straightforward](https://caddy.community/t/implementing-cors-whitelist-in-caddy-v2/8590/11)), but it seems to work. @LeonardMeyer , you don't have...

> I don't understand why the first request is answered 302 ? I recommend creating two different routes. One for API endpoints and another one for non-API endpoint. In non-API...

@LeonardMeyer , i totally misunderstood the above. You get 302 because authorizer did not find token, or it is expired.

> There's just one minor thing that is bothering me... With my Caddyfile and what happens with the https://github.com/greenpau/caddy-security/issues/90#issuecomment-1129398616 above when token expires, the redirection to login happens only if...

@LeonardMeyer , did you have a chance to review this https://github.com/greenpau/caddy-security/issues/24#issuecomment-1019633596? i.e. there is a difference between: ``` crypto default token lifetime ... cookie lifetime ... ```