Open
Description
Description
Allow customization for CORS Access-Control-Allow-Headers
Discussion
https://keycloak.discourse.group/t/customizing-access-control-allow-headers/7672
Motivation
Keycloak has to support custom headers.
The lacking of this functionality makes keycloak incompatible, for example, with distributed tracing systems (opentelemetry, elastic-agent).
These are some of the headers that are commonly sent :
traceparent
uber-trace-id
x-amzn-trace-id
x-b3-sampled
x-b3-spanid
x-b3-traceid
elastic-apm-traceparent
Details
Access-Control-Allow-Headers are stubbed in
Please allow customization for Access-Control-Allow-Headers via GUI (in clients configurations) or via environment variables.