The spec says in a red note that
An IDP MUST check the referrerOrigin header to ensure that a malicious RP does not receive an ID token corresponding to another RP. In other words, the IDP MUST check that the referrerOrigin header is represented by the client_id. As the client_id are IDP-specific, the user agent cannot perform this check.
This seems a crucial check that the IdP must implement, as it would otherwise allow anyone the get the user's id token. Wouldn't it be safer to enforce CORS here (i.e.: the user agent throws an exception if the response does not include the correct Access-Control-Allow-Origin header)? CORS exist exactly for this usecase. And this would make it impossible for IdPs to forget to implement this check.
The spec says in a red note that
This seems a crucial check that the IdP must implement, as it would otherwise allow anyone the get the user's id token. Wouldn't it be safer to enforce CORS here (i.e.: the user agent throws an exception if the response does not include the correct
Access-Control-Allow-Originheader)? CORS exist exactly for this usecase. And this would make it impossible for IdPs to forget to implement this check.