Generic OIDC application for SPA (ownCloud oCIS)

[YDKK]

What is the name of the domain?

example.com

What is the issue you’re encountering

Generic OIDC application could not use with SPAs (without client_secret)

What are the steps to reproduce the issue?

ownCloud oCIS (the new ownCloud server written in Golang) uses an SPA (Single Page Application) for its frontend. Therefore, it uses the Authorization Code-Flow with PKCE without client_secret in its OIDC authentication protocol.
When I try to set up oCIS as a Generic OIDC application in Cloudflare Access, I encounter two issues:

1. Because there is no client_secret, the client fails to authenticate with the OIDC token endpoint and returns an invalid_client error.
2. Because the OIDC token endpoint does not specify CORS headers, the browser fails to fetch the token.

Is there any plan for Cloudflare Access’s OIDC to support these SPAs that do not use a Client Secret?

Example docker compose configuration for oCIS to reproduce:

services:
  ocis:
    ports:
      - 8080:9200
    image: owncloud/ocis:7.0.0
    entrypoint:
      - /bin/sh
    command: ["-c", "ocis init || true; ocis server"]
    environment:
      # IDP specific configuration
      PROXY_AUTOPROVISION_ACCOUNTS: "true"
      PROXY_ROLE_ASSIGNMENT_DRIVER: "default"
      PROXY_OIDC_REWRITE_WELLKNOWN: "true"
      OCIS_OIDC_ISSUER: https://example.cloudflareaccess.com/cdn-cgi/access/sso/oidc/xxxx
      WEB_OIDC_CLIENT_ID: xxxx
      # general config
      OCIS_URL: http://localhost:8080
      PROXY_TLS: "false"
      PROXY_USER_OIDC_CLAIM: "email"
      PROXY_USER_CS3_CLAIM: "mail"
      OCIS_INSECURE: "true"
      OCIS_ADMIN_USER_ID: "[email protected]"
      OCIS_EXCLUDE_RUN_SERVICES: "idp"
      GRAPH_ASSIGN_DEFAULT_USER_ROLE: "false"
      GRAPH_USERNAME_MATCH: "none"
    volumes:
      - ocis-config:/etc/ocis
      - ocis-data:/var/lib/ocis

volumes:
  ocis-config:
  ocis-data:

Below are some relevant URLs for reference:

OIDC with SPA (Owncloud OCIS)

OIDC Client Secret

Screenshot of the error