Closed
Description
Description
Every request to refresh a token is accompanied by a debug log with an issue about CORS
2025-05-06 14:51:29,039 DEBUG [org.keycloak.services.cors.DefaultCors] (executor-thread-7) Invalid CORS request: origin https://192.168.17.10 not in allowed origins []
2025-05-06 14:51:29,040 DEBUG [org.keycloak.events] (executor-thread-7) type="REFRESH_TOKEN" ...
It's suspicious because the client is requesting the exactly the host from which the app is loaded (https://192.168.17.10) for which no CORS should be taken into account.
NOTE: Keycloak and the webapp itself are behind a reverse proxy (nginx) with X-Forwarded headers tuned.
Discussion
No response
Motivation
No response
Details
No response