X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/eee13aa7003afff6ccf390ac92fe2b4a525d16f9..e302c2a74072ebe734adfb45fc6b525f299bb9fb:/services/api/config/routes.rb

diff --git a/services/api/config/routes.rb b/services/api/config/routes.rb
index 2481d5aed5..27fd67cece 100644
--- a/services/api/config/routes.rb
+++ b/services/api/config/routes.rb
@@ -78,6 +78,8 @@ Server::Application.routes.draw do
   # omniauth
   match '/auth/:provider/callback', :to => 'user_sessions#create'
   match '/auth/failure', :to => 'user_sessions#failure'
+  # not handled by omniauth provider -> 403 with no CORS headers.
+  get '/auth/*a', :to => 'user_sessions#cross_origin_forbidden'
 
   # Custom logout
   match '/login', :to => 'user_sessions#login'