Keycloak does not allow to update client with localhost Redirect URI #44575

elizavetaKrainova · 2025-12-01T09:28:39Z

elizavetaKrainova
Dec 1, 2025

Hello everyone!

Since the beginning of the week I am facing a strange issue. I am trying to add http://localhost:8080/* value to Clients/{client-name}/Settings/Valid redirect URIs, but every time get "Client could not be updated:" error.

Client can be saved with any other URI, but everything that includes "localhost" is rejected. Besides, there are some other Clients where I can't update anything.

Another detail that I've noticed is that requests with redirect_uri=http://localhost:8080/* always return Forbidden 403 instead of invalid_redirect_uri error. Wildcard doesn't help in my case (not production, just dev instance).

It looks like there might be some permissions issue, but I've tried to play around: assigned all possible permissions to my user, assigned only client-specific permissions. Nothing seems to work. Logs are also empty, they seem to save only successful admin events.

Would be thankful for any hints. Keycloak version is 23.0.7. I know it should be updated as soon as possible, but I am not allowed to do that at the moment.

darius-m · 2025-12-02T12:44:02Z

darius-m
Dec 2, 2025

For the cause of the error, also try looking at the Keycloak server's (CLI) logs (kubectl logs, docker logs, etc., or the log output file if running Keycloak natively) as well as the browser's developer tools' console and for denied requests in the Network tab. The reason may be a policy that does not allow non-encrypted connections (using http) or configuring wildcard for the redirect URI.

Regarding the redirect_uri=http://localhost:8000/* - that looks like a query parameter for an OIDC authentication request. In that case, you must specify a complete redirect URL where Keycloak will redirect the browser with the authentication code, back to the application. The /* path is very likely not a valid path in any web application and this is likely why the request is blocked; yo 8000 u will need a full valid path, something like /auth/oidc/redirect, as defined by the application itself.

0 replies

Navigation Menu

Repository navigation

Keycloak does not allow to update client with localhost Redirect URI #44575

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Keycloak does not allow to update client with localhost Redirect URI #44575

Uh oh!

Uh oh!

elizavetaKrainova Dec 1, 2025

Replies: 1 comment

Uh oh!

darius-m Dec 2, 2025

elizavetaKrainova
Dec 1, 2025

darius-m
Dec 2, 2025