3:39 a.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Hello,
I've noticed that KC sets the CORS headers only during pre-flight
request, not on the regular requests. While this is in accordance with
the documentation, I'm wondering if there's a reason for not sending
the CORS headers for non-OPTIONS headers as well. As it currently is,
I'd have to implement the CORS response filter in my application
anyway, so, I'm wondering in which scenarios I'd delegate this to KC.
By the way, it seems that setting "enable-cors" to false has no
effect, as the headers are still being added by KC.
Juca.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEcBAEBCgAGBQJTPFlTAAoJEDnJtskdmzLMWsMIAJ8vUxOUz+XKJQqQD5TceG40
d0A0TZC4zuypgezorGASvL7mSb7NbElytI07zXfH1fD/kNwCZn3wO1oyXNjGA+BY
TzVB+jfViDpEYNYqtlL93WlkcqS+uaAmrBL0ag1N6L1OHWlN7QnYhxIZckSgTW99
t0P3U02Qr0dnmKuS8JzeKemKKC8rF3uR0cIBRi7+s3gsBUXDWmL9fYAvzcSLcX5h
mA4Qn7eGCW6T5bSE6HzTzCtSxFbpkuSRQwXb77+n4HnZ2RHMGdeDLcMcObEIr2RF
63w2XafaJ2/p9yVRL55gwuyQH198p8dzpvBfvxO5sGMreTCeWt2nDfnBrjBNxek=
=DfVk
-----END PGP SIGNATURE-----
4:30 a.m.
Which headers are we not sending back? The way it works is that for
non-authenticated requests, we do handle pre-flight requests, but not
regular requests. If the request is authenticated then we valid the
origin vs. the allowed origins in the token.
On 4/2/2014 2:39 PM, Juraci Paixão Kröhling wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Hello,
I've noticed that KC sets the CORS headers only during pre-flight
request, not on the regular requests. While this is in accordance with
the documentation, I'm wondering if there's a reason for not sending
the CORS headers for non-OPTIONS headers as well. As it currently is,
I'd have to implement the CORS response filter in my application
anyway, so, I'm wondering in which scenarios I'd delegate this to KC.
By the way, it seems that setting "enable-cors" to false has no
effect, as the headers are still being added by KC.
Juca.
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEcBAEBCgAGBQJTPFlTAAoJEDnJtskdmzLMWsMIAJ8vUxOUz+XKJQqQD5TceG40
d0A0TZC4zuypgezorGASvL7mSb7NbElytI07zXfH1fD/kNwCZn3wO1oyXNjGA+BY
TzVB+jfViDpEYNYqtlL93WlkcqS+uaAmrBL0ag1N6L1OHWlN7QnYhxIZckSgTW99
t0P3U02Qr0dnmKuS8JzeKemKKC8rF3uR0cIBRi7+s3gsBUXDWmL9fYAvzcSLcX5h
mA4Qn7eGCW6T5bSE6HzTzCtSxFbpkuSRQwXb77+n4HnZ2RHMGdeDLcMcObEIr2RF
63w2XafaJ2/p9yVRL55gwuyQH198p8dzpvBfvxO5sGMreTCeWt2nDfnBrjBNxek=
=DfVk
-----END PGP SIGNATURE-----
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
3:37 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
On 04/02/2014 09:30 PM, Bill Burke wrote:
Which headers are we not sending back?
The Access-Control-* headers for non-preflight requests (ie: a POST).
Without an additional filter at the application side that adds CORS
headers to the non-OPTIONS requests, the browsers would prevent the
webapp from reading the response.
I guess the question then is: why are the authenticated, non-preflight
requests, not handled? I might be wrong, but I think that KC already
has all the information it needs to handle such requests, no?
Juca.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEcBAEBCgAGBQJTPQGoAAoJEDnJtskdmzLMDogH/2ZrUhDI3zQysMc735rDmb1u
T12iLE5OgtvQs23GyKvCRFfv827xTXrs+WXDJKI6jiWrraAcoTTLX3CZh702S8Xz
NWNUuv3j7rYKgChSqMnU+y43a2b6K9mQSx59gXRqKWo2mTLKtVFvPnR5CA40bpH2
JZh13pPW1jB/klSBq2ZEe/km+eE3Av5KRE+RqifWVk9ktN43uOjNAnw1oRnIpamO
Ch2GQPDxEXQM7JEmJum8u5IVnAC14juhltk5UiCZFNqnaYa389UAs9J9DlvwgSVr
6s+pBuP2CO17Hwes921DxLZOkFSObAI+0jzZcOLRD61Js9qiB52B844Lxd/hRm0=
=bQkI
-----END PGP SIGNATURE-----
10:25 p.m.
On 4/3/2014 2:37 AM, Juraci Paixão Kröhling wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
On 04/02/2014 09:30 PM, Bill Burke wrote:
> Which headers are we not sending back?
The Access-Control-* headers for non-preflight requests (ie: a POST).
Without an additional filter at the application side that adds CORS
headers to the non-OPTIONS requests, the browsers would prevent the
webapp from reading the response.
I guess the question then is: why are the authenticated, non-preflight
requests, not handled? I might be wrong, but I think that KC already
has all the information it needs to handle such requests, no?
Authenticated, non-preflight requests are handled. Non-authenticated
requests are not handled.
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
11:14 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
On 04/03/2014 03:25 PM, Bill Burke wrote:
Authenticated, non-preflight requests are handled.
Non-authenticated requests are not handled.
Ok, I'm not sure if you mean that the second part is for
"non-preflight" as well. In any case, the authorization header is not
sent on the preflight (understandably), so, I guess you meant
"non-authenticated" on the first part.
A couple of requests/responses from my application, to illustrate what
is currently happening:
Pre-flight (OPTIONS) request, without authentication (CORS sent)
- - http://pastebin.com/45raBqy0
Non-preflight (POST), authenticated (no CORS sent):
http://pastebin.com/E9B6iaAE
Because of the second request, Chrome (and possibly other browsers)
will not deliver the response to the web application, even though it
executed the request (as it was allowed by the CORS from the first
request).
Is this how it should be, or is there a bug somewhere?
- - Juca.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEcBAEBCgAGBQJTPWzaAAoJEDnJtskdmzLMfncH/0iWPnCPOXCeD4ckmSfNGM9Z
vx4fmVrWrr1BExzfmJqeqOfVYnGfaVKgN0U3Dq1mRexGW7hedybHhXwTiJME5SH3
48fvoAUzekXMLk1OhlFdHKzQmCCbI8GdtdebAri7gigqVNBMI/usOPkY1kUGxbTO
w12PZqwnaUgSbHuwL/5zKLuhMF16TqzPan1E1jj3yhKGtZBCJz8TA0G6dHv76LbL
Y4ociQEJOsy3TFym4PSES8gQ24sDtR8WQPycl/Q88PvI+7SkZ6lGfq4SYhNXYcIY
gh/5v/MQXlGKAHN5doNbRlpWPqozWHK9/RqV34qtG9S5w3eNz6DeetpWdDzYOYg=
=WhPv
-----END PGP SIGNATURE-----
11:20 p.m.
Have you specified any web origins for your application?
----- Original Message -----
From: "Juraci Paixão Kröhling" <juraci(a)kroehling.de>
To: keycloak-user(a)lists.jboss.org
Sent: Thursday, 3 April, 2014 3:14:50 PM
Subject: Re: [keycloak-user] CORS only for OPTIONS?
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
On 04/03/2014 03:25 PM, Bill Burke wrote:
> Authenticated, non-preflight requests are handled.
> Non-authenticated requests are not handled.
Ok, I'm not sure if you mean that the second part is for
"non-preflight" as well. In any case, the authorization header is not
sent on the preflight (understandably), so, I guess you meant
"non-authenticated" on the first part.
A couple of requests/responses from my application, to illustrate what
is currently happening:
Pre-flight (OPTIONS) request, without authentication (CORS sent)
- - http://pastebin.com/45raBqy0
Non-preflight (POST), authenticated (no CORS sent):
http://pastebin.com/E9B6iaAE
Because of the second request, Chrome (and possibly other browsers)
will not deliver the response to the web application, even though it
executed the request (as it was allowed by the CORS from the first
request).
Is this how it should be, or is there a bug somewhere?
- - Juca.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEcBAEBCgAGBQJTPWzaAAoJEDnJtskdmzLMfncH/0iWPnCPOXCeD4ckmSfNGM9Z
vx4fmVrWrr1BExzfmJqeqOfVYnGfaVKgN0U3Dq1mRexGW7hedybHhXwTiJME5SH3
48fvoAUzekXMLk1OhlFdHKzQmCCbI8GdtdebAri7gigqVNBMI/usOPkY1kUGxbTO
w12PZqwnaUgSbHuwL/5zKLuhMF16TqzPan1E1jj3yhKGtZBCJz8TA0G6dHv76LbL
Y4ociQEJOsy3TFym4PSES8gQ24sDtR8WQPycl/Q88PvI+7SkZ6lGfq4SYhNXYcIY
gh/5v/MQXlGKAHN5doNbRlpWPqozWHK9/RqV34qtG9S5w3eNz6DeetpWdDzYOYg=
=WhPv
-----END PGP SIGNATURE-----
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
11:23 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Yes, there are two apps in the game:
- - frontend, with http://127.0.0.1:9000 as an allowed origin
- - backend, bearer-only, without origins defined
Frontend is an HTML-only application, while backend is a REST-only API.
- - Juca.
On 04/03/2014 04:20 PM, Stian Thorgersen wrote:
Have you specified any web origins for your application?
----- Original Message -----
> From: "Juraci Paixão Kröhling" <juraci(a)kroehling.de> To:
> keycloak-user(a)lists.jboss.org Sent: Thursday, 3 April, 2014
> 3:14:50 PM Subject: Re: [keycloak-user] CORS only for OPTIONS?
>
On 04/03/2014 03:25 PM, Bill Burke wrote:
>>> Authenticated, non-preflight requests are handled.
>>> Non-authenticated requests are not handled.
Ok, I'm not sure if you mean that the second part is for
"non-preflight" as well. In any case, the authorization header is
not sent on the preflight (understandably), so, I guess you meant
"non-authenticated" on the first part.
A couple of requests/responses from my application, to illustrate
what is currently happening:
Pre-flight (OPTIONS) request, without authentication (CORS sent) -
http://pastebin.com/45raBqy0
Non-preflight (POST), authenticated (no CORS sent):
http://pastebin.com/E9B6iaAE
Because of the second request, Chrome (and possibly other
browsers) will not deliver the response to the web application,
even though it executed the request (as it was allowed by the CORS
from the first request).
Is this how it should be, or is there a bug somewhere?
- Juca.
> _______________________________________________ keycloak-user
> mailing list keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEcBAEBCgAGBQJTPW7WAAoJEDnJtskdmzLM9YEH/3xE0Czb06QSpN/tJYBh93wn
rUcGXwiH3PqVtOqJcBmCWfYD734Zqe2ZfG2UN3E12VT4gWuA73SlE2lhHqt5/KS+
6G4gKuH45EXkO3GgdpTm60qPIRpBQbR0UjFo+k1dhR/f4ck3VR2uPLmmWvAeREpG
sMlu8ZbR/S0EO6by69Lp3l3TcXYKuYdEDBK404i7Js46r8IgMAE4c/Mx8ZtRTAQa
1liqg5YQ16DkuBd0m45Vhdk1gseSe+vUHSOyF46+J/daOn4THsaLMebYKXAAAp3s
uIG3tMyKx/q6E7pICHD+/iW04NlPoHevcbFlLhSnwz8O8oH19Yr4WuYcSKKhaTI=
=SfMO
-----END PGP SIGNATURE-----
7:07 a.m.
What he means is, did you register your web origins in the admin console
for the realm's registered application?
On 4/3/2014 10:23 AM, Juraci Paixão Kröhling wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Yes, there are two apps in the game:
- - frontend, with http://127.0.0.1:9000 as an allowed origin
- - backend, bearer-only, without origins defined
Frontend is an HTML-only application, while backend is a REST-only API.
- - Juca.
On 04/03/2014 04:20 PM, Stian Thorgersen wrote:
> Have you specified any web origins for your application?
>
> ----- Original Message -----
>> From: "Juraci Paixão Kröhling" <juraci(a)kroehling.de> To:
>> keycloak-user(a)lists.jboss.org Sent: Thursday, 3 April, 2014
>> 3:14:50 PM Subject: Re: [keycloak-user] CORS only for OPTIONS?
>>
> On 04/03/2014 03:25 PM, Bill Burke wrote:
>>>> Authenticated, non-preflight requests are handled.
>>>> Non-authenticated requests are not handled.
>
> Ok, I'm not sure if you mean that the second part is for
> "non-preflight" as well. In any case, the authorization header is
> not sent on the preflight (understandably), so, I guess you meant
> "non-authenticated" on the first part.
>
> A couple of requests/responses from my application, to illustrate
> what is currently happening:
>
> Pre-flight (OPTIONS) request, without authentication (CORS sent) -
> http://pastebin.com/45raBqy0
>
> Non-preflight (POST), authenticated (no CORS sent):
> http://pastebin.com/E9B6iaAE
>
> Because of the second request, Chrome (and possibly other
> browsers) will not deliver the response to the web application,
> even though it executed the request (as it was allowed by the CORS
> from the first request).
>
> Is this how it should be, or is there a bug somewhere?
>
> - Juca.
>> _______________________________________________ keycloak-user
>> mailing list keycloak-user(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEcBAEBCgAGBQJTPW7WAAoJEDnJtskdmzLM9YEH/3xE0Czb06QSpN/tJYBh93wn
rUcGXwiH3PqVtOqJcBmCWfYD734Zqe2ZfG2UN3E12VT4gWuA73SlE2lhHqt5/KS+
6G4gKuH45EXkO3GgdpTm60qPIRpBQbR0UjFo+k1dhR/f4ck3VR2uPLmmWvAeREpG
sMlu8ZbR/S0EO6by69Lp3l3TcXYKuYdEDBK404i7Js46r8IgMAE4c/Mx8ZtRTAQa
1liqg5YQ16DkuBd0m45Vhdk1gseSe+vUHSOyF46+J/daOn4THsaLMebYKXAAAp3s
uIG3tMyKx/q6E7pICHD+/iW04NlPoHevcbFlLhSnwz8O8oH19Yr4WuYcSKKhaTI=
=SfMO
-----END PGP SIGNATURE-----
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
5:05 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Yes. In the admin console for my realm, I have two applications, as
described before :-)
- frontend, with http://127.0.0.1:9000 as an allowed origin -
backend, bearer-only, without origins defined
Besides those two, there's a third application on the realm, which
comes by default when creating the realm: "account".
- - Juca.
On 04/04/2014 12:07 AM, Bill Burke wrote:
> What he means is, did you register your web origins in the admin
> console for the realm's registered application?
>
> On 4/3/2014 10:23 AM, Juraci Paixão Kröhling wrote: Yes, there are
> two apps in the game:
>
- frontend, with http://127.0.0.1:9000 as an allowed origin -
backend, bearer-only, without origins defined
>
> Frontend is an HTML-only application, while backend is a REST-only
> API.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEcBAEBCgAGBQJTPmfNAAoJEDnJtskdmzLMF/QH/15IG0a8V8DpCXCNcV96rF1r
qLx0rtDLkHEeLf6FL2+FhBEOTiaQCjBhrQta+VF7PLEq7z3wo4AAqTOf1WMVsikj
vJG76v8ychj1AoZ8Fe2AC+5PswAGsdvXIzPHzQEctXO+nrec6aSrU/oriAaHA0Np
5DHbNVFmM/10xOkkFXioKP3XFJBBRdjUMbMjEwPgnE8wLtwG0VdsQwfPA9l/Vb1M
a9J39QN8cAIJb9Y8kuWgse/80Y5Zm+bdxGlEJLnS1U6ux3XRZxs7JqZTk7uIMlSU
a24xlEjJNaEJOlXUcz+TRZvA+9Q/tzRkRA5MyTDJ7E8PCg4QGo6FjlMyhAPA0cg=
=mECM
-----END PGP SIGNATURE-----
9:41 p.m.
The adapter doesn't load the CORS properties from the config. Updated with:
https://github.com/keycloak/keycloak/commit/2916cce6fb8c7a8b7797c255ec820...
----- Original Message -----
From: "Juraci Paixão Kröhling" <juraci(a)kroehling.de>
To: keycloak-user(a)lists.jboss.org
Sent: Friday, 4 April, 2014 9:05:33 AM
Subject: Re: [keycloak-user] CORS only for OPTIONS?
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Yes. In the admin console for my realm, I have two applications, as
described before :-)
> - frontend, with http://127.0.0.1:9000 as an allowed origin -
> backend, bearer-only, without origins defined
Besides those two, there's a third application on the realm, which
comes by default when creating the realm: "account".
- - Juca.
On 04/04/2014 12:07 AM, Bill Burke wrote:
> What he means is, did you register your web origins in the admin
> console for the realm's registered application?
>
> On 4/3/2014 10:23 AM, Juraci Paixão Kröhling wrote: Yes, there are
> two apps in the game:
>
> - frontend, with http://127.0.0.1:9000 as an allowed origin -
> backend, bearer-only, without origins defined
>
> Frontend is an HTML-only application, while backend is a REST-only
> API.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEcBAEBCgAGBQJTPmfNAAoJEDnJtskdmzLMF/QH/15IG0a8V8DpCXCNcV96rF1r
qLx0rtDLkHEeLf6FL2+FhBEOTiaQCjBhrQta+VF7PLEq7z3wo4AAqTOf1WMVsikj
vJG76v8ychj1AoZ8Fe2AC+5PswAGsdvXIzPHzQEctXO+nrec6aSrU/oriAaHA0Np
5DHbNVFmM/10xOkkFXioKP3XFJBBRdjUMbMjEwPgnE8wLtwG0VdsQwfPA9l/Vb1M
a9J39QN8cAIJb9Y8kuWgse/80Y5Zm+bdxGlEJLnS1U6ux3XRZxs7JqZTk7uIMlSU
a24xlEjJNaEJOlXUcz+TRZvA+9Q/tzRkRA5MyTDJ7E8PCg4QGo6FjlMyhAPA0cg=
=mECM
-----END PGP SIGNATURE-----
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
10:30 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Thanks Stian! With the commit right after this one (aec8feab4) it
works fine!
Juca.
On 04/07/2014 02:41 PM, Stian Thorgersen wrote:
The adapter doesn't load the CORS properties from the config.
Updated with:
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEcBAEBCgAGBQJTQqh+AAoJEDnJtskdmzLMht8H/isFcU2JPiOEDG9TmiOEIOcW
YrV6I8gC4f8Gts7JG0s5E60O3fhOmN84HLd/U6xB+Q9iGCAMNle/s+2Ck2fnPrbQ
QrHkbxnIDpeK0y5JG98bFnnlEL7vhXjamBH7pQHXIysh3ZZ84yojcB0MjNcsjoML
5DF8mIu5+eUWecWWtulsB2Hgdk+dE2jXWy/DwVkEUPLb9adYxikb7cg6YQJKEsks
5lOMpkjoyQbMsxNu2s3kqrIMuJTh66+MOCWz1hReSDh2hnTv2bXPkerqauBdo1pt
nOLGnbdkRCOb+ij9dA0MSUgfX93lPD3TLTwf1G6WAqJ+cp09HpkGNmq5oBSTM8E=
=sD1P
-----END PGP SIGNATURE-----
3683
days inactive
3688
days old
10 comments
3 participants
participants (3)
-
Bill Burke -
Juraci Paixão Kröhling -
Stian Thorgersen