Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

option_passthrough.png

I was looking through the <https://www.ory.sh/docs/kratos/reference/configuration-editor|kratos config editor> when I came across this (see attached image)

I could guess what this does, however I'd really like a description.

Nevermind, I think I figured out what it is.

I decided to dig through the repo a bit and found myself the <https://github.com/ory/kratos/blob/master/cmd/daemon/serve.go|kratos/cmd/daemon/serve.go> file.

There I found out that you guys use the <https://github.com/rs/cors|rs/cors> package (so essentially kratos is just exposing the `OptionsPassthrough` parameter).

I guess my confusion originated from why this option was exposed in the first place. Because kratos is kind-of the end point for a CORS preflight request, I struggled to find a solid reason for why this should be exposed at all. I guess its just best practise?

Not sure why it is exposed to be honest, never had a case where you need this though :thinking_face:  so you can most likely disregard