Re: [keycloak-user] CORS only for OPTIONS?

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On 04/02/2014 09:30 PM, Bill Burke wrote: The Access-Control-* headers for non-preflight requests (ie: a POST). Without an additional filter at the application side that adds CORS headers to the non-OPTIONS requests, the browsers would prevent the webapp from reading the response. I guess the question then is: why are the authenticated, non-preflight requests, not handled? I might be wrong, but I think that KC already has all the information it needs to handle such requests, no? Juca.