Make CORS work for oauth2 handlers

[wxiaoguang]

Fix #25473

Although there was m.Post("/login/oauth/access_token", CorsHandler() ... ,it never really worked, because it still lacks the "OPTIONS" handler.

After the fix:

$ curl -v -X OPTIONS --header "Access-Control-Request-Method: POST" http://localhost:3000/login/oauth/access_token
*   Trying 127.0.0.1:3000...
> OPTIONS /login/oauth/access_token HTTP/1.1
> Accept: */*
> Access-Control-Request-Method: POST
>
< HTTP/1.1 200 OK
< Vary: Origin
< Vary: Access-Control-Request-Method
< Vary: Access-Control-Request-Headers
< X-Frame-Options: SAMEORIGIN
< X-Gitea-Debug: RUN_MODE=dev
< Date: Thu, 23 Nov 2023 11:45:36 GMT
< Content-Length: 0



$ curl -v -X OPTIONS http://localhost:3000/login/oauth/access_token
> OPTIONS /login/oauth/access_token HTTP/1.1
> Accept: */*
>
< HTTP/1.1 400 Bad Request
< Vary: Origin
< X-Frame-Options: SAMEORIGIN
< X-Gitea-Debug: RUN_MODE=dev
< Date: Thu, 23 Nov 2023 11:45:32 GMT
< Content-Length: 0

ps: I haven't fully tested the "oauth2 cors client", we can make further fixes if there are still problems.

[delvh]

I don't quite understand, why do we need these routes?
Are they required by OAuth?

[wxiaoguang]

I don't quite understand, why do we need these routes?

Because the "OPTIONS" is a separate request before "POST" (for CORS)

[morphelinho]

Still observing a similar problem:

Request URL: https://gitea-instance/login/oauth/userinfo
Request Method: OPTIONS
Status Code: 405 Method Not Allowed

Server side log:
2023/12/18 20:52:13 cmd/web.go:111:showWebStartupMessage() [I] Gitea version: 1.21.2 built with GNU Make 4.4.1, go1.21.5 : bindata, timetzdata, sqlite, sqlite_unlock_notify
...
2023/12/18 21:11:36 ...eb/routing/logger.go:102:func1() [I] router: completed OPTIONS /login/oauth/userinfo for XXX.XXX.XXX.XXX, 405 Method Not Allowed in 0.2ms @ web/goget.go:20(web.goGet)

Any help would be appreciated.

[wxiaoguang]

Because /login/oauth/userinfo was never covered by CORS.

This PR only fixes the access_token handler.

It could simply add a new line m.Options("/login/oauth/userinfo", CorsHandler(), misc.DummyBadRequest) to make userinfo work, you can try to build your own binary to see whether it works well (I don't use it so my test doesn't mean it really works as your expectation)