I'd like to be able to run auth refresh if there's a CORS error. I've set this up with a library that uses the Salesforce REST API to refresh access tokens, but I've found that the Salesforce API doesn't returns CORS headers once your access token has expired. Therefore, even though the API returns a 401, the browser won't see because the API doesn't returns CORS headers if the access token isn't valid (how silly).

In that scenario, an error like this would be logged to the console:

Access to XMLHttpRequest at 'https://....salesforce.com/services/data/...' from origin '...' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

However, there's no specific way to detect this from the callback, so you'd have to intercept all errors.

One way to enable this generically would be to allow using a custom shouldInterceptError method to decide whether to intercept the request. That allows handling this scenario, or any other custom logic.