Hi everyone,
We recently ran into this exact same issue (CORS errors and 302 redirects when trying to create a new course via the Authoring MFE) and spent some time debugging the network traces. I wanted to share our findings and the definitive solution, as this is essentially an architectural clash between modern JWT authentication and legacy Studio cookie-based authentication.
The Problem & Root Cause
The Authoring MFE communicates with the backend in two different ways:
-
Modern APIs (JWT): Most of the MFE uses modern API endpoints (like /api/contentstore/v1/home) which authenticate seamlessly using the JWT token provided by the LMS. These calls work perfectly.
-
Legacy Endpoints (Cookies): Certain actions, such as clicking “New Course”, trigger background XHR/Fetch requests to legacy Django views in Studio (specifically the /organizations endpoint to populate the dropdown). These legacy endpoints do not accept JWT; they strictly require the studio_session_id cookie.
The Breaking Point: If your MFE’s LOGIN_URL is configured to point directly to the LMS (e.g., https://lms.yourdomain.com/login), the user authenticates, gets a JWT, and is redirected straight back to the MFE. Because the user bypassed the Studio backend during login, the studio_session_id cookie is never initialized.
When the MFE makes an XHR request to /organizations without that cookie, Studio treats the user as anonymous and returns an HTTP 302 Redirect to the SSO login. Since this is an AJAX request, the browser attempts to follow the redirect silently, hits the SSO server, and gets blocked by CORS policies.
Steps to Reproduce
-
In your mfe_config, ensure the Authoring MFE’s LOGIN_URL is pointing directly to the LMS.
-
Open a new incognito window (or clear your cookies) and navigate directly to the Authoring MFE (https://apps.yourdomain.com/authoring/home).
-
Log in using your credentials. (Notice that the MFE loads your courses successfully because it uses JWT).
-
Click the “New course” button.
-
Nothing happens in the UI, but if you check the Network tab/Console, you will see a CORS error caused by a 302 Found response from the /organizations endpoint redirecting to OAuth.
The Solution
To fix this, you need to ensure the user passes through the Studio backend so the session cookie is correctly stamped.
You must update the LOGIN_URL configuration for the Authoring MFE so that it points to Studio’s login rather than the LMS directly.
- Change
LOGIN_URL to: https://studio.yourdomain.com/login/
By doing this, when an unauthenticated user accesses the MFE, they are routed through Studio’s login endpoint. Studio will handle the OAuth2 flow with the LMS, properly execute the callback (/complete/edx-oauth2/), initialize the studio_session_id cookie, and then land the user on the MFE.
Once that cookie is present in the browser, the XHR calls to /organizations return a 200 OK, and the course creation form opens without any CORS errors.
I have attached a video demonstrating both scenarios to make this crystal clear: first, accessing directly from the Authoring MFE path (/authoring/home) to show how it fails, and second, accessing from the base Studio URL (without any path) to show how it successfully initializes the session and works perfectly.
Hope this helps save some debugging time for future operators!