Uploaded image for project: 'Keycloak'
  1. Keycloak
  2. KEYCLOAK-6090

Token endpoint doesn't add CORS headers to error responses

    Details

    • Type: Bug
    • Status: Resolved (View Workflow)
    • Priority: Major
    • Resolution: Done
    • Affects Version/s: 3.4.2.Final
    • Fix Version/s: 3.4.3.Final, 4.0.0.CR1
    • Component/s: None
    • Labels:
      None
    • Steps to Reproduce:
      Hide
      • Success (Response: { "access_token": "...", "expires_in": ... , "refresh_token": "..." ... }

        )

      • Unable to load response status code, due to CORS error response.
      • First request is successful, so entire configuration, including Web origins, is fine.
      • Reproduced at latest 3.4.2.Final release.
      Show
      Send direct grant flow request from web SPA (eg.Angular): POST http://localhost:8080/auth/realms/master/protocol/openid-connect/token \ -H 'content-type: application/x-www-form-urlencoded' \ -d 'username=user1&password=123456&grant_type=password&client_id=admin-cli' Success (Response: { "access_token": "...", "expires_in": ... , "refresh_token": "..." ... } ) Same request with wrong username: POST http://localhost:8080/auth/realms/master/protocol/openid-connect/token \ -H 'content-type: application/x-www-form-urlencoded' \ -d 'username=user2&password=123456&grant_type=password&client_id=admin-cli' Failed (Response: 401 (Unauthorized) + CORS error, Failed to load http://localhost:8080/auth/realms/master/protocol/openid-connect/token: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:4200' is therefore not allowed access. The response had HTTP status code 401. ) Unable to load response status code, due to CORS error response. First request is successful, so entire configuration, including Web origins, is fine. Reproduced at latest 3.4.2.Final release.
    • Docs QE Status:
      NEW
    • QE Status:
      ASSIGNED

      Description

      Related to KEYCLOAK-1886 , which is marked as resolved, but still reproducible at 3.4.2.Final. (Request to add detail desc how to reproduce is added).

        Gliffy Diagrams

          Attachments

            Activity

              People

              • Assignee:
                stianst Stian Thorgersen
                Reporter:
                mirzaha Mirza Hadžiomerović
                Tester:
                Michal Hajas
              • Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: