8000 KEYCLOAK-5141 Return '*' in Cors requests when '*' is in list of perm… by stianst · Pull Request #4290 · keycloak/keycloak · GitHub
[go: up one dir, main page]

Skip to content

KEYCLOAK-5141 Return '*' in Cors requests when '*' is in list of perm… - #4290

Merged
stianst merged 1 commit into
keycloak:masterfrom
stianst:KEYCLOAK-5141
Jul 5, 2017
Merged

stianst merged 1 commit into
keycloak:masterfrom
stianst:KEYCLOAK-5141

Conversation

@stianst
@stianst stianst commented Jul 5, 2017
Copy link
Copy Markdown
Contributor

…itted origins. Stop caching well-known information as it can change.

@stianst stianst self-assigned this Jul 5, 2017
…itted origins. Stop caching well-known information as it can change.
@stianst
stianst merged commit c95aace into keycloak:master Jul 5, 2017
@stianst
stianst deleted the KEYCLOAK-5141 branch August 31, 2017 04:29
@phillipj
phillipj commented Jan 9, 2018
Copy link
Copy Markdown

@stianst I'm wondering if I've stumbled upon an unexpected behaviour because of these changes.

In a project I'm working on, we have been using * in the list of web origins in our test environments. Started seeing CORS requests failing after upgrading Keycloak v3.2.1-Final to v3.4.0-Final;

Failed to load https://x.y.z/auth/realms/Users/protocol/openid-connect/token: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. Origin 'http://192.168.x.y:3000' is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

This results in us not being able to have wildcard CORS, causing lots of head ache especially when developing and testing our services.

Did you consider HTTP requests sending credentials and thus not allowing wildcard as values in the Access-Control-Allow-Origin header?

@phillipj
Copy link
Copy Markdown

@stianst would you be positive if I opened a PR reverting what's necessary to avoid the errors we're seeing ☝️

@stianst
stianst commented Jan 31, 2018 via email
Copy link
Copy Markdown
Contributor Author

@phillipj
Copy link
Copy Markdown

Oh that's great news, thanks! I'm currently on v3.4.0-Final so I'll give v3.4.3-Final a shot.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

0