403 calling Hosted Backend /app/refresh API
-
I'm trying to use the Hosted Backend /app/refresh API to manually refresh tokens using a valid refresh token (obtained from an external JWT reconcile call).
Using Curl as follows (sensitive values xxxx'ed out):
curl -v -X POST --cookie "app.rt=_xxxxx" http://localhost:9011/app/xxxxx
returns a 403 even though the rt and application client id are correct.
Any idea why this is happening? Running licensed starter edition, v1.69.4 locally on port 9011.
Thanks!
-
@andrzej-taramina Usually, when we see 403s on the hosted backend, the root cause ends up being an origin issue.
The endpoint calls need to originate from the same domain the FusionAuth instance lives at
There's some CORS information in this section of the hosted backend docs: https://fusionauth.io/docs/apis/hosted-backend#prerequisites