Keycloak angular No 'Access-Control-Allow-Origin' header is present

Question

I Have integrated keycloak with an angular app. Basically, both frontend and backend are on different server.Backend app is running on apache tomcat 8. Frontend app is running on JBoss welcome content folder.

Angular config

angular.element(document).ready(function ($http) {     var keycloakAuth = new Keycloak('keycloak.json');     auth.loggedIn = false;     keycloakAuth.init({ onLoad: 'login-required' }).success(function () {         keycloakAuth.loadUserInfo().success(function (userInfo) {             console.log(userInfo);           });         auth.loggedIn = true;         auth.authz = keycloakAuth;         auth.logoutUrl = keycloakAuth.authServerUrl + "/realms/app1/protocol/openid-connect/logout?redirect_uri=http://35.154.214.8/hrms-keycloak/index.html";         module.factory('Auth', function() {             return auth;         });         angular.bootstrap(document, ["themesApp"]);     }).error(function () {             window.location.reload();         });  }); module.factory('authInterceptor', function($q, Auth) {     return {         request: function (config) {             var deferred = $q.defer();             if (Auth.authz.token) {                 Auth.authz.updateToken(5).success(function() {                     config.headers = config.headers || {};                     config.headers.Authorization = 'Bearer ' + Auth.authz.token;                     deferred.resolve(config);                 }).error(function() {                         deferred.reject('Failed to refresh token');                     });             }             return deferred.promise;         }     }; }); module.config(["$httpProvider", function ($httpProvider)  {     $httpProvider.interceptors.push('authInterceptor'); }]); 

Request Header

Accept:*/* Accept-Encoding:gzip, deflate Accept-Language:en-US,en;q=0.8 Access-Control-Request-Headers:authorization Access-Control-Request-Method:GET Connection:keep-alive Host:35.154.214.8:8080 Origin:http://35.154.214.8 Referer:http://35.154.214.8/accounts-keycloak/ User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36 

Error on web console.

XMLHttpRequest cannot load http://35.154.214.8:8080/company/loadCurrencyList. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://35.154.214.8' is therefore not allowed access. 

Cors filter on backend

@Component public class CORSFilter implements Filter {     static Logger logger = LoggerFactory.getLogger(CORSFilter.class);      @Override     public void init(FilterConfig filterConfig) throws ServletException {     }      @Override     public void doFilter(ServletRequest request, ServletResponse res,             FilterChain chain) throws IOException, ServletException {         HttpServletResponse response = (HttpServletResponse) res;         response.setHeader("Access-Control-Allow-Origin", "*");         response.setHeader("Access-Control-Allow-Methods", "*");         response.setHeader("Access-Control-Max-Age", "3600");         response.setHeader("Access-Control-Allow-Headers", "*");         chain.doFilter(request, response);     }      public void destroy() {     } } 

Answer 1

I was fighting with KeyCloak and CORS and all of this for about two weeks, and this is my solution (for keycloak 3.2.1):

Its all about configuring KeyCloak server. It seems to be, that WebOrigin of your Realm needs to be

*

Only one origin "*".

Thats all, what was needed for me.

If you enter your server as WebOrigin, the trouble begins. When you call keycloak.init in JavaScript, keycloak does not generate CORS headers, so you have to configure them manually, and as soon as you do so, and call keycloak.getUserInfo after successful init - you get double CORS headers, which is not allowed.

Somewhere deep inside of keycloak mailing lists is stated, that you need to set enable-cors=true in your keycloak.json, but there is nothing about that on keycloak.gitbooks.io. So it seems not to be true.

They also don't mention CORS when describing JavaScript and Node.Js adapters, and I don't know why, seems not to be important at all.

It also seems to be, that you should not touch WildFly configuration to provide CORS headers.

Besides, CORS in OIDC is a special KeyCloak feature (and not a bug).

Hopefully this answer serves you well.

Answer 2

It's important to note that setting your web origin to "*" opens a gaping security hole. It allows any script from any domain to make requests on behalf of a user, within that user's browser.

Whenever you find yourself disabling a security feature in a way like this, you need to consider why the security feature exists.

See "Web Origins" in 8.1.1 of the Keycloak docs