Keycloak angular No ‘Access-Control-Allow-Origin’ header is present

I was fighting with KeyCloak and CORS and all of this for about two weeks, and this is my solution (for keycloak 3.2.1):

Its all about configuring KeyCloak server.
It seems to be, that WebOrigin of your Realm needs to be

*

Only one origin “*”.

Thats all, what was needed for me.

If you enter your server as WebOrigin, the trouble begins.
When you call keycloak.init in JavaScript, keycloak does not generate CORS headers, so you have to configure them manually, and as soon as you do so, and call keycloak.getUserInfo after successful init – you get double CORS headers, which is not allowed.

Somewhere deep inside of keycloak mailing lists is stated, that you need to set enable-cors=true in your keycloak.json, but there is nothing about that on keycloak.gitbooks.io. So it seems not to be true.

They also don’t mention CORS when describing JavaScript and Node.Js adapters, and I don’t know why, seems not to be important at all.

It also seems to be, that you should not touch WildFly configuration to provide CORS headers.

Besides, CORS in OIDC is a special KeyCloak feature (and not a bug).

Hopefully this answer serves you well.

Leave a Comment