Yes, but should I have to register that URI?
I thought that the ssl-required option was only valid for communications with the keycloak server, not on how the keycloak server would respond to the application.
The solution would be to register this https uri as a redirect_uri on my keycloak application?
While we're on this topic I do have another question, that my superiors instructed me to ask:
Is it unsafe to change my keycloak.json setting ssl-required to none?
The problem I see is someone intercepting the access code returned by the server, is it possible for 2 requests with the same access code be processed returning a valid access token for both? Or is this code discarded somehow?
Thank you again for all your help