Add CORS support to OIDC dynamic client registration endpoints #43625
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
server-spi-private/src/main/java/org/keycloak/http/simple/SimpleHttpRequest.java
Dismissed
Show dismissed
Hide dismissed
c24430b to
3f2ba02
Compare
Closes keycloak#8863 Signed-off-by: stianst <[email protected]>
3f2ba02 to
1388ae9
Compare
Unreported flaky test detectedIf the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.federation.ldap.LDAPProvidersIntegrationTest#updateLDAPUsernameTest |
mposolda
reviewed
Oct 23, 2025
| } | ||
|
|
||
| if (failOnInvalidOrigin) { | ||
| throw new ForbiddenException("Invalid origin"); |
There was a problem hiding this comment.
Is this ok from the backwards compatibility?
Just wondering about the use-case like:
- Initial access token (or registration access token) migrated from previous version. So without any
allowed-originsinside - Client registration request, which used
Originheader. The request was not necessarily sent from the browser SPA and hence there was not CORS error (even if CORS headers were not added in the response). Now it would be 403 returned.
At the same time, I am not sure if it is valid to assume that client-registration request can use Origin header even if not sent from the browser SPA. Is it rather a corner-case, which we can ignore?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Still need to update Admin UI to allow creating initial access tokens with allowed web origins.
Closes #8863
Signed-off-by: stianst [email protected]