[keycloak-dev] modeling CORS support

Here's my thoughts on modeling CORS. * We'll take the access token approach to support CORS * There will be a default set of allowed origins configurable at the realm level. * Each Application and OAuth Client within the realm can add their own allowed origins. When an Application or OAuth Client initiates a token grant request, the token will be populated with the allowed origins configured for that Application or OAuth client. * Application adapters will have configuration switches to allow all method/headers. Later on we will add options in the management interfaces to configure headers/methods as well. Bill -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com