I fixed this by adding:
app.use(
'/forest/authentication',
cors({
...corsConfig,
// The null origin is sent by browsers for redirected AJAX calls
// we need to support this in authentication routes because OIDC
// redirects to the callback route
origin: corsConfig.origin.concat('null')
})
);
app.use(
jwt({
secret: process.env.FOREST_AUTH_SECRET,
credentialsRequired: false,
algorithms: ['HS256']
})
);
but it would be nice to add this information to documentation.