I have a react + node express application that uses passport-SAML to protect some routes, via a 3rd party IDP. It works as intended. The problem I am having is that I’ve been trying to find a way to make a request to the express API to find if the client has logged out of the IDP, otherwise my site will keep remaining logged-in until a refresh.

I have tried creating a GET endpoint that is also authenticated. Basically it gives me the current user’s ID. If I use the browser’s address bar it works perfectly, I either get the user’s ID, or I get shown the login page. The problem is that if I then use, e.g., AXIOS to make the request I get a CORS error, basically saying the the IDP doesn’t like the cross domain.

I thought I might try to fool the IDP, and make a self-request to see what happens. So I make an AXIOS request using window.location.href, the same URL I am on, but I still get the CORS error.

Does anybody know how to solve this problem?