fix: cors error if BasePath is set

Duendes `.UseIdentityServer()` uses the `BasePath` set by
`app.UsePathBase()` which works properly with CORS
unlike `BasePathMiddleware` and `.UseWhen()`.

e2e/tests/base-path.spec.ts

@@ -19,6 +19,16 @@ describe('Base path', () => {
     expect(result).toHaveProperty('token_endpoint', process.env.OIDC_TOKEN_URL_WITH_BASE_PATH);
   });
 
+  test('CORS', async () => {
+    const origin = 'https://google.com';
+    const response = await fetch(process.env.OIDC_DISCOVERY_ENDPOINT_WITH_BASE_PATH, {
+      headers: {
+        origin,
+      },
+    });
+    expect(response.headers.get('access-control-allow-origin')).toEqual(origin);
+  });
+
   test('Token Endpoint', async () => {
     if (!client) throw new Error('Client not found');
 

src/Program.cs

@@ -1,9 +1,7 @@
-using Duende.IdentityServer.Hosting;
-using Microsoft.Extensions.FileProviders;
+using Microsoft.Extensions.FileProviders;
 using OpenIdConnectServer;
 using OpenIdConnectServer.Helpers;
 using OpenIdConnectServer.JsonConverters;
-using OpenIdConnectServer.Middlewares;
 using OpenIdConnectServer.Services;
 using OpenIdConnectServer.Validation;
 using Serilog;
@@ -53,6 +51,7 @@
 
 var app = builder.Build();
 
+app.UsePathBase(Config.GetAspNetServicesOptions().BasePath);
 
 var aspNetServicesOptions = Config.GetAspNetServicesOptions();
 AspNetServicesHelper.ConfigureAspNetServices(builder.Services, aspNetServicesOptions);
@@ -65,16 +64,6 @@
 
 app.UseIdentityServer();
 
-var basePath = Config.GetAspNetServicesOptions().BasePath;
-if (!string.IsNullOrEmpty(basePath))
-{
-    app.UseWhen(ctx => ctx.Request.Path.StartsWithSegments(basePath), appBuilder =>
-    {
-        appBuilder.UseMiddleware<BasePathMiddleware>();
-        appBuilder.UseMiddleware<IdentityServerMiddleware>();
-    });
-}
-
 app.UseHttpsRedirection();
 
 var manifestEmbeddedProvider = new ManifestEmbeddedFileProvider(typeof(Program).Assembly, "wwwroot");