Same origin policy restricts login in Sitecore10.2 application

Question

Background of the issue:

We are upgrading from Sitecore 9.2 to Sitecore 10.2 without Sitecore identity server. We are using Ping ID as an Identity provider using Saml2.0 protocol. In application, while clicking on Login button (which will navigate to Ping ID login page on successful redirect), it shows the same-origin policy origin error for Horizon URL. Due to which redirect to Ping ID login page is failed.

Error details:

Login button in application:

Request and Response details from network tab: 1 -> Sitecore application URL 2 -> Sitecore Horizon URL

Error response details:

Solutions tried:

Solution1: Included below config changes in Web.config file of Sitecore application:

<configuration>
<system.webServer>
      <httpProtocol>
        <customHeaders>          
          <add name="Access-Control-Allow-Origin" value="https://<Horizon URL>" />
          <add name="Access-Control-Allow-Methods" value="*" />
          <add name="Access-Control-Allow-Headers" value="*" />
        </customHeaders>
      </httpProtocol>
</system.webServer>
</configuration>

Solution2: Enable Cors in Controller level where Login functionality handled:

namespace Feature.Login.Controllers
{
    [EnableCors(origins: "https://<Horizon URL>", headers: "*", methods: "*")]
    public class UserLoginController : Controller
    {
        // GET: User
        /// <summary>
        /// Logins to the application with the respective user
        /// </summary>
        /// <returns>LoginLinks.cshtml</returns>
        public ActionResult SSOLogin()
        {
}
}
}

Solution3: Enable CORS origin for Sitecore applicatioin URL in Web.Config file of Horizon web root:

<configuration>
 <system.webServer>
    <security>
      <requestFiltering>
        <requestLimits maxQueryString="32768" />
      </requestFiltering>
    </security>
    <handlers>
      <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />
    </handlers>
    <aspNetCore processPath="dotnet" arguments=".\Sitecore.AuthoringHost.dll" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" hostingModel="OutOfProcess" />
    <httpProtocol>
    <customHeaders>
    <add name="Access-Control-Allow-Origin" value="*" />
            <add name="Access-Control-Allow-Methods" value="*" />
            <add name="Access-Control-Allow-Headers" value="*" />
    </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>

But, nothing was worked out. Please help us to fix this issue.

Answer 1

The issue is due to incorrect Meta data configuration between current system (9.2) and new system (10.2). After compare the meta data configurations, found and corrected the meta data, issue got resolved. Thanks.