CORS Error when Keycloak Token Timesout #10185

tomsontom · 2020-06-23T09:52:37Z

Describe the bug
If you enable OIDC Support with Keycloak calls to REST-APIs start to fail once the Token provided by Keycloak is timed out with an CORS-Failure like this:

Access to XMLHttpRequest at 'http://localhost:8081/auth/realms/keycloak-cors-public/protocol/openid-connect/auth?redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fhello&state=ba3be67d-a18b-4c6f-acb9-6e617c05674e&scope=openid&response_type=code&client_id=quarkus' (redirected from 'http://localhost:8080/hello') from origin 'http://localhost:8080' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

GET http://localhost:8081/auth/realms/keycloak-cors-public/protocol/openid-connect/auth?redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fhello&state=ba3be67d-a18b-4c6f-acb9-6e617c05674e&scope=openid&response_type=code&client_id=quarkus net::ERR_FAILED

Uncaught (in promise) Error: Network Error
    at e.exports (spread.js:25)
    at XMLHttpRequest.l.onerror (spread.js:25)

Expected behavior
The timeout of the token should not lead to an error

Actual behavior
CORS Error produced

To Reproduce
Clone https://github.com/tomsontom/keycloak-cors/ and follow the steps there

Configuration

quarkus.oidc.auth-server-url=${AUTH_URL}
quarkus.oidc.client-id=quarkus
quarkus.oidc.credentials.secret=${AUTH_CREDENTIALS}
quarkus.oidc.application-type=web-app
quarkus.http.auth.permission.authenticated.paths=/*
quarkus.http.auth.permission.authenticated.policy=authenticated

Screenshots

Environment (please complete the following information):

Output of uname -a or ver: Darwin Toms-MacBook-Pro.local 19.5.0 Darwin Kernel Version 19.5.0: Tue May 26 20:41:44 PDT 2020; root:xnu-6153.121.2~2/RELEASE_X86_64 x86_64
Output of java -version: openjdk version "11.0.6" 2020-01-14
GraalVM version (if different from Java): -
Quarkus version or git rev: 1.5.2.final
Build tool (ie. output of mvnw --version or gradlew --version): 3.6.3

Additional context

Working request/response look like this:

General:

Request URL: http://localhost:8080/hello
Request Method: GET
Status Code: 200 OK
Remote Address: [::1]:8080
Referrer Policy: no-referrer-when-downgrade

Response Headers:

Content-Length: 5
Content-Type: text/plain;charset=UTF-8

Request Headers:

Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Connection: keep-alive
Cookie: q_session=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJLSjBBcjZrUnFyWEFYajNlVmdGMFk2MUp4aEt4V2NWU1lDUE5HVHJMNFBVIn0.eyJqdGkiOiI3ODAxYjMzYS1hMDlmLTRhNTktYWY4Mi03NmY1MzNiNzA1OGMiLCJleHAiOjE1OTI5MDMxNzEsIm5iZiI6MCwiaWF0IjoxNTkyOTAzMTExLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycy1wdWJsaWMiLCJhdWQiOiJxdWFya3VzIiwic3ViIjoiNmFhYmU4YmEtYmFjNy00OTdjLTljMzItYWIwYjlkYmM2NzFlIiwidHlwIjoiSUQiLCJhenAiOiJxdWFya3VzIiwiYXV0aF90aW1lIjoxNTkyOTAzMTExLCJzZXNzaW9uX3N0YXRlIjoiN2UyZTYzMzktMDYzOS00YmY5LWExYmEtMzQ4ZDRkODIxMGRlIiwiYWNyIjoiMSIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwicHJlZmVycmVkX3VzZXJuYW1lIjoidGVzdCJ9.FkVV5YkOkFgrRU6I_xGTAJmlJdrNj5NbCrR8_kNYvzScVFTyQcE0W1F7b7NnokWTfZjE-PWvNtG602djiihaS00y5TYHh5mCVHNVUzVyG85A0VJovuxvrlfCLnxu0w8WSF4E3KC5twgD_Zf3YAkPpi1t-PXi9B4mSLC0GwOcvtdanW6Ul72evwk_TVeeZBzLDyEApiFuZkZ2MK5kuxV7M2W6_4CJntXA18dpGMoTZ2Ue3wVFOzalk2u2J96jFT3OtbIj9oRMVju-9fy8l1Lks88dQnzAI-x9BSk787yT8IVgA-VCeo5zAERcjBe8LPnJUD4MfrrS2Cj0vCIvCga6mg|eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJLSjBBcjZrUnFyWEFYajNlVmdGMFk2MUp4aEt4V2NWU1lDUE5HVHJMNFBVIn0.eyJqdGkiOiI4MDc2NjYwNi00OTU2LTQ5YzYtYWFhYS0yMDIxNDA4N2Q0NTUiLCJleHAiOjE1OTI5MDMxNzEsIm5iZiI6MCwiaWF0IjoxNTkyOTAzMTExLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycy1wdWJsaWMiLCJhdWQiOiJhY2NvdW50Iiwic3ViIjoiNmFhYmU4YmEtYmFjNy00OTdjLTljMzItYWIwYjlkYmM2NzFlIiwidHlwIjoiQmVhcmVyIiwiYXpwIjoicXVhcmt1cyIsImF1dGhfdGltZSI6MTU5MjkwMzExMSwic2Vzc2lvbl9zdGF0ZSI6IjdlMmU2MzM5LTA2MzktNGJmOS1hMWJhLTM0OGQ0ZDgyMTBkZSIsImFjciI6IjEiLCJhbGxvd2VkLW9yaWdpbnMiOlsiaHR0cDovL2xvY2FsaG9zdDo4MDgwIl0sInJlYWxtX2FjY2VzcyI6eyJyb2xlcyI6WyJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgZW1haWwgcHJvZmlsZSIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwicHJlZmVycmVkX3VzZXJuYW1lIjoidGVzdCJ9.YSIQeitfiVHTN6pvfud-oW4sncfU_2NgWssAKmAYlKgOFzJyyTKbPyXCljRL3Smm-pSz0tlnVXIps-Qb6NihV7yJUr1fCn9z5AnqhNl9PQSRJ6VAJDmKyLbgtu81GNQ3vg_pYF94dmqpTzvoBLaa5OPOGACmpesCKUvUyGlTG1HPFfNsgfc-6-p2ozj-XVbPYanLFDFWliuFPv6TrhEg3SP4vyySVPltBk9-BgIGn8sCncb7m5ox0DXCzBlFQ-oaVbO9htbp5HIXFWUbYE5yfBEHnmHGFIaJIlO8YtYv9_t3YrKJwQkgP19Ej7MOZNCeQA8grYMlpbjN3YylPnDKSQ|eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJiZDdkYjg5Yy00NWJkLTQ1MDktODFkMi1lN2IxYjMxYjBhNDYifQ.eyJqdGkiOiI5NTQxY2U5My04MDlkLTRjNjQtODVjMy00ZWZmN2Q3YTg2YzgiLCJleHAiOjE1OTI5MDQ5MTEsIm5iZiI6MCwiaWF0IjoxNTkyOTAzMTExLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycy1wdWJsaWMiLCJhdWQiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycy1wdWJsaWMiLCJzdWIiOiI2YWFiZThiYS1iYWM3LTQ5N2MtOWMzMi1hYjBiOWRiYzY3MWUiLCJ0eXAiOiJSZWZyZXNoIiwiYXpwIjoicXVhcmt1cyIsImF1dGhfdGltZSI6MCwic2Vzc2lvbl9zdGF0ZSI6IjdlMmU2MzM5LTA2MzktNGJmOS1hMWJhLTM0OGQ0ZDgyMTBkZSIsInJlYWxtX2FjY2VzcyI6eyJyb2xlcyI6WyJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgZW1haWwgcHJvZmlsZSJ9.gOCSVyXETE24TJntdbLByVcKLFSOWIonQ5MXO9zuMFs
Host: localhost:8080
Referer: http://localhost:8080/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

Failing request/response look like this:

General:

Request URL: http://localhost:8080/hello
Request Method: GET
Status Code: 302 Found
Remote Address: [::1]:8080
Referrer Policy: no-referrer-when-downgrade

Response Headers:

content-length: 0
location: http://localhost:8081/auth/realms/keycloak-cors-public/protocol/openid-connect/auth?redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fhello&state=ba3be67d-a18b-4c6f-acb9-6e617c05674e&scope=openid&response_type=code&client_id=quarkus
set-cookie: q_auth=ba3be67d-a18b-4c6f-acb9-6e617c05674e; Max-Age=1800; Expires=Tue, 23 Jun 2020 09:36:13 GMT; HTTPOnly

Request Headers:

Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Connection: keep-alive
Host: localhost:8080
Referer: http://localhost:8080/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

General:

Request URL: http://localhost:8081/auth/realms/keycloak-cors-public/protocol/openid-connect/auth?redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fhello&state=ba3be67d-a18b-4c6f-acb9-6e617c05674e&scope=openid&response_type=code&client_id=quarkus
Referrer Policy: no-referrer-when-downgrade

Response Headers:

Cache-Control: no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Language: en
Content-Length: 3089
Content-Security-Policy: frame-src 'self'; frame-ancestors 'self'; object-src 'none';
Content-Type: text/html;charset=utf-8
Date: Tue, 23 Jun 2020 09:06:13 GMT
Set-Cookie: AUTH_SESSION_ID=b2d2fe22-a5ec-4ea7-bcfc-3f248d07ee56.0a08cbc5521a; Version=1; Path=/auth/realms/keycloak-cors-public/; HttpOnly
Set-Cookie: KC_RESTART=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJiZDdkYjg5Yy00NWJkLTQ1MDktODFkMi1lN2IxYjMxYjBhNDYifQ.eyJjaWQiOiJxdWFya3VzIiwicHR5Ijoib3BlbmlkLWNvbm5lY3QiLCJydXJpIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL2hlbGxvIiwiYWN0IjoiQVVUSEVOVElDQVRFIiwibm90ZXMiOnsic2NvcGUiOiJvcGVuaWQiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycy1wdWJsaWMiLCJyZXNwb25zZV90eXBlIjoiY29kZSIsInJlZGlyZWN0X3VyaSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9oZWxsbyIsInN0YXRlIjoiYmEzYmU2N2QtYTE4Yi00YzZmLWFjYjktNmU2MTdjMDU2NzRlIn19.Bj9kuulCAHnH17VjkgpqZUwG21uLObERAOi4rVbtSrE; Version=1; Path=/auth/realms/keycloak-cors-public/; HttpOnly
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Robots-Tag: none
X-XSS-Protection: 1; mode=block

Request Headers:

Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Connection: keep-alive
Host: localhost:8081
Origin: http://localhost:8080
Referer: http://localhost:8080/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

Query String Parameters:

redirect_uri: http://localhost:8080/hello
state: ba3be67d-a18b-4c6f-acb9-6e617c05674e
scope: openid
response_type: code
client_id: quarkus

The text was updated successfully, but these errors were encountered:

sberyozkin · 2020-06-23T09:59:26Z

@tomsontom Thanks.
So the question is, what happens with the very 1st successful http://localhost:8080/hello request ? This should also do a redirect.

sberyozkin · 2020-06-23T10:01:00Z

CC @pedroigor @stuartwdouglas

sberyozkin · 2020-06-23T10:21:14Z

It feels like it is about tweaking the same origin browser policy somehow.

tomsontom · 2020-06-23T10:25:44Z

@sberyozkin well why should the first request lead to a redirect? The user logs when one fetches the index.html site and hence the token is valid at that point.

Now the page does not get reloaded for $x minutes and when issuing a request afterwards no cookie is sent with the request:

Working GET-Call:

Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Connection: keep-alive
Cookie: q_session=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJLSjBBcjZrUnFyWEFYajNlVmdGMFk2MUp4aEt4V2NWU1lDUE5HVHJMNFBVIn0.eyJqdGkiOiI3ODAxYjMzYS1hMDlmLTRhNTktYWY4Mi03NmY1MzNiNzA1OGMiLCJleHAiOjE1OTI5MDMxNzEsIm5iZiI6MCwiaWF0IjoxNTkyOTAzMTExLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycy1wdWJsaWMiLCJhdWQiOiJxdWFya3VzIiwic3ViIjoiNmFhYmU4YmEtYmFjNy00OTdjLTljMzItYWIwYjlkYmM2NzFlIiwidHlwIjoiSUQiLCJhenAiOiJxdWFya3VzIiwiYXV0aF90aW1lIjoxNTkyOTAzMTExLCJzZXNzaW9uX3N0YXRlIjoiN2UyZTYzMzktMDYzOS00YmY5LWExYmEtMzQ4ZDRkODIxMGRlIiwiYWNyIjoiMSIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwicHJlZmVycmVkX3VzZXJuYW1lIjoidGVzdCJ9.FkVV5YkOkFgrRU6I_xGTAJmlJdrNj5NbCrR8_kNYvzScVFTyQcE0W1F7b7NnokWTfZjE-PWvNtG602djiihaS00y5TYHh5mCVHNVUzVyG85A0VJovuxvrlfCLnxu0w8WSF4E3KC5twgD_Zf3YAkPpi1t-PXi9B4mSLC0GwOcvtdanW6Ul72evwk_TVeeZBzLDyEApiFuZkZ2MK5kuxV7M2W6_4CJntXA18dpGMoTZ2Ue3wVFOzalk2u2J96jFT3OtbIj9oRMVju-9fy8l1Lks88dQnzAI-x9BSk787yT8IVgA-VCeo5zAERcjBe8LPnJUD4MfrrS2Cj0vCIvCga6mg|eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJLSjBBcjZrUnFyWEFYajNlVmdGMFk2MUp4aEt4V2NWU1lDUE5HVHJMNFBVIn0.eyJqdGkiOiI4MDc2NjYwNi00OTU2LTQ5YzYtYWFhYS0yMDIxNDA4N2Q0NTUiLCJleHAiOjE1OTI5MDMxNzEsIm5iZiI6MCwiaWF0IjoxNTkyOTAzMTExLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycy1wdWJsaWMiLCJhdWQiOiJhY2NvdW50Iiwic3ViIjoiNmFhYmU4YmEtYmFjNy00OTdjLTljMzItYWIwYjlkYmM2NzFlIiwidHlwIjoiQmVhcmVyIiwiYXpwIjoicXVhcmt1cyIsImF1dGhfdGltZSI6MTU5MjkwMzExMSwic2Vzc2lvbl9zdGF0ZSI6IjdlMmU2MzM5LTA2MzktNGJmOS1hMWJhLTM0OGQ0ZDgyMTBkZSIsImFjciI6IjEiLCJhbGxvd2VkLW9yaWdpbnMiOlsiaHR0cDovL2xvY2FsaG9zdDo4MDgwIl0sInJlYWxtX2FjY2VzcyI6eyJyb2xlcyI6WyJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgZW1haWwgcHJvZmlsZSIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwicHJlZmVycmVkX3VzZXJuYW1lIjoidGVzdCJ9.YSIQeitfiVHTN6pvfud-oW4sncfU_2NgWssAKmAYlKgOFzJyyTKbPyXCljRL3Smm-pSz0tlnVXIps-Qb6NihV7yJUr1fCn9z5AnqhNl9PQSRJ6VAJDmKyLbgtu81GNQ3vg_pYF94dmqpTzvoBLaa5OPOGACmpesCKUvUyGlTG1HPFfNsgfc-6-p2ozj-XVbPYanLFDFWliuFPv6TrhEg3SP4vyySVPltBk9-BgIGn8sCncb7m5ox0DXCzBlFQ-oaVbO9htbp5HIXFWUbYE5yfBEHnmHGFIaJIlO8YtYv9_t3YrKJwQkgP19Ej7MOZNCeQA8grYMlpbjN3YylPnDKSQ|eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJiZDdkYjg5Yy00NWJkLTQ1MDktODFkMi1lN2IxYjMxYjBhNDYifQ.eyJqdGkiOiI5NTQxY2U5My04MDlkLTRjNjQtODVjMy00ZWZmN2Q3YTg2YzgiLCJleHAiOjE1OTI5MDQ5MTEsIm5iZiI6MCwiaWF0IjoxNTkyOTAzMTExLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycy1wdWJsaWMiLCJhdWQiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycy1wdWJsaWMiLCJzdWIiOiI2YWFiZThiYS1iYWM3LTQ5N2MtOWMzMi1hYjBiOWRiYzY3MWUiLCJ0eXAiOiJSZWZyZXNoIiwiYXpwIjoicXVhcmt1cyIsImF1dGhfdGltZSI6MCwic2Vzc2lvbl9zdGF0ZSI6IjdlMmU2MzM5LTA2MzktNGJmOS1hMWJhLTM0OGQ0ZDgyMTBkZSIsInJlYWxtX2FjY2VzcyI6eyJyb2xlcyI6WyJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgZW1haWwgcHJvZmlsZSJ9.gOCSVyXETE24TJntdbLByVcKLFSOWIonQ5MXO9zuMFs
Host: localhost:8080
Referer: http://localhost:8080/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

Failing GET-Call

Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Connection: keep-alive
Host: localhost:8080
Referer: http://localhost:8080/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

Well failing is wrong - this call leads to 302-response with the location-header set. What I'm not sure about is keycloak is at fail or quarkus. So could it be that keycloak is the one responsible for the abortion because it gets a cross-domain request? Or maybe what I write is completely bogus because this is clearly not my area of expertise ;-)

sberyozkin · 2020-06-23T10:39:13Z

@tomsontom My assumption has been that the user logins with the very 1st GET to the hello endpoint...
OK, I think we are getting closer to the route of the problem... But we need a consistent view of what is going on. I propose to focus on a single Quarkus resource only, be it either index.html (which is shipped with Quarkus) or localhost:8080/hello.
Let it be index.html
So, Tom, please paste the traces of 1) the very 1st access to index.html, browser <-> Quarkus, browser-Keycloak. 2) the same when the id token expires. Or make sure the very 1st request goes to localhost:8080/hello (no index.html is fetched) and do 1) and 2) for localhost:8080/hello.

It will give us a clear view of what is different between the two cases.
I think that once the browser sets Origin when redirecting to KC, KC should respond with the CORS headers. I don't understand why no problem exists in the initial login.

Sorry I'm not helping much at the moment as I'm coding something else right now :-), but we are very close :-)

tomsontom · 2020-06-23T10:53:30Z

Ok so the initial fetch of index.html looks like this:

General:

Request URL: http://localhost:8080/
Request Method: GET
Status Code: 302 Found
Remote Address: [::1]:8080
Referrer Policy: no-referrer-when-downgrade

Response Headers:

content-length: 0
location: http://localhost:8081/auth/realms/keycloak-cors/protocol/openid-connect/auth?redirect_uri=http%3A%2F%2Flocalhost%3A8080%2F&state=bd813703-a121-4780-b9cf-913a80de2a91&scope=openid&response_type=code&client_id=quarkus
set-cookie: q_auth=bd813703-a121-4780-b9cf-913a80de2a91; Max-Age=1800; Expires=Tue, 23 Jun 2020 11:14:09 GMT; HTTPOnly

Request Headers:

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Connection: keep-alive
Host: localhost:8080
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

which leads to:

General

Request URL: http://localhost:8081/auth/realms/keycloak-cors/protocol/openid-connect/auth?redirect_uri=http%3A%2F%2Flocalhost%3A8080%2F&state=bd813703-a121-4780-b9cf-913a80de2a91&scope=openid&response_type=code&client_id=quarkus
Request Method: GET
Status Code: 200 OK
Remote Address: [::1]:8081
Referrer Policy: no-referrer-when-downgrade

Response Headers:

Cache-Control: no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Language: en
Content-Length: 3068
Content-Security-Policy: frame-src 'self'; frame-ancestors 'self'; object-src 'none';
Content-Type: text/html;charset=utf-8
Date: Tue, 23 Jun 2020 10:44:09 GMT
Set-Cookie: AUTH_SESSION_ID=8fdb1e59-97a5-4b36-a9bf-801649771675.0a08cbc5521a; Version=1; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KC_RESTART=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJjaWQiOiJxdWFya3VzIiwicHR5Ijoib3BlbmlkLWNvbm5lY3QiLCJydXJpIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwLyIsImFjdCI6IkFVVEhFTlRJQ0FURSIsIm5vdGVzIjp7InNjb3BlIjoib3BlbmlkIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgxL2F1dGgvcmVhbG1zL2tleWNsb2FrLWNvcnMiLCJyZXNwb25zZV90eXBlIjoiY29kZSIsInJlZGlyZWN0X3VyaSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC8iLCJzdGF0ZSI6ImJkODEzNzAzLWExMjEtNDc4MC1iOWNmLTkxM2E4MGRlMmE5MSJ9fQ.BOFKHDn-QABw7EY-s7ZuTC2KmH1BuOtcN4ZOKIEcMRo; Version=1; Path=/auth/realms/keycloak-cors/; HttpOnly
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Robots-Tag: none
X-XSS-Protection: 1; mode=block

Request Headers:

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Connection: keep-alive
Cookie: q_auth=bd813703-a121-4780-b9cf-913a80de2a91
Host: localhost:8081
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

Query String Parameters:

redirect_uri: http://localhost:8080/
state: bd813703-a121-4780-b9cf-913a80de2a91
scope: openid
response_type: code
client_id: quarkus

tomsontom · 2020-06-23T11:01:24Z

Now executing the log-in leads to:
General:

Request URL: http://localhost:8081/auth/realms/keycloak-cors/login-actions/authenticate?session_code=qLM9u05m45VTh7CPccgOttumnGO-dv3a6hyAgSt8eXU&execution=43becedf-17e0-4d09-bfac-85c8c726cf0d&client_id=quarkus&tab_id=95_tqq_f-gg
Request Method: POST
Status Code: 302 Found
Remote Address: [::1]:8081
Referrer Policy: no-referrer-when-downgrade

Response Headers:

Cache-Control: no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 0
Date: Tue, 23 Jun 2020 10:54:17 GMT
Location: http://localhost:8080/?state=bd813703-a121-4780-b9cf-913a80de2a91&session_state=8fdb1e59-97a5-4b36-a9bf-801649771675&code=ea3c6b21-16c3-4b7d-ae57-659cdede1b44.8fdb1e59-97a5-4b36-a9bf-801649771675.94240a55-7a91-4621-98f2-f4c162f83f78
P3P: CP="This is not a P3P policy!"
Set-Cookie: KEYCLOAK_LOCALE=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KC_RESTART=; Version=1; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KEYCLOAK_IDENTITY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJqdGkiOiIyNWU1MWFkYy0zMmI3LTQ4YTAtYWM2NC04NWQ0ZTFjNWM4YzgiLCJleHAiOjE1OTI5NDU2NTcsIm5iZiI6MCwiaWF0IjoxNTkyOTA5NjU3LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsInN1YiI6IjRhZGRlMmQwLTAwODUtNDYyMC05NzI1LWY3YWMwMDFmZmQ5MCIsInR5cCI6IlNlcmlhbGl6ZWQtSUQiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiI4ZmRiMWU1OS05N2E1LTRiMzYtYTliZi04MDE2NDk3NzE2NzUiLCJzdGF0ZV9jaGVja2VyIjoiZi13UmpxcFRGS2M4T3BSXzh5bkgyWkx1TzdJXzk3WWwyX2wwbnh3SkhGMCJ9.75-fLkmNlEbQUbQvgbd9nk8mSqhYJSbjwYJ9p25bbP8; Version=1; Path=/auth/realms/keycloak-cors/; SameSite=None; Secure; HttpOnly
Set-Cookie: KEYCLOAK_IDENTITY_LEGACY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJqdGkiOiIyNWU1MWFkYy0zMmI3LTQ4YTAtYWM2NC04NWQ0ZTFjNWM4YzgiLCJleHAiOjE1OTI5NDU2NTcsIm5iZiI6MCwiaWF0IjoxNTkyOTA5NjU3LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsInN1YiI6IjRhZGRlMmQwLTAwODUtNDYyMC05NzI1LWY3YWMwMDFmZmQ5MCIsInR5cCI6IlNlcmlhbGl6ZWQtSUQiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiI4ZmRiMWU1OS05N2E1LTRiMzYtYTliZi04MDE2NDk3NzE2NzUiLCJzdGF0ZV9jaGVja2VyIjoiZi13UmpxcFRGS2M4T3BSXzh5bkgyWkx1TzdJXzk3WWwyX2wwbnh3SkhGMCJ9.75-fLkmNlEbQUbQvgbd9nk8mSqhYJSbjwYJ9p25bbP8; Version=1; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KEYCLOAK_SESSION=keycloak-cors/4adde2d0-0085-4620-9725-f7ac001ffd90/8fdb1e59-97a5-4b36-a9bf-801649771675; Version=1; Expires=Tue, 23-Jun-2020 20:54:17 GMT; Max-Age=36000; Path=/auth/realms/keycloak-cors/; SameSite=None; Secure
Set-Cookie: KEYCLOAK_SESSION_LEGACY=keycloak-cors/4adde2d0-0085-4620-9725-f7ac001ffd90/8fdb1e59-97a5-4b36-a9bf-801649771675; Version=1; Expires=Tue, 23-Jun-2020 20:54:17 GMT; Max-Age=36000; Path=/auth/realms/keycloak-cors/
Set-Cookie: KEYCLOAK_REMEMBER_ME=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/keycloak-cors/; HttpOnly

Request Headers:

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cache-Control: max-age=0
Connection: keep-alive
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Cookie: AUTH_SESSION_ID=8fdb1e59-97a5-4b36-a9bf-801649771675.0a08cbc5521a; KC_RESTART=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJjaWQiOiJxdWFya3VzIiwicHR5Ijoib3BlbmlkLWNvbm5lY3QiLCJydXJpIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwLyIsImFjdCI6IkFVVEhFTlRJQ0FURSIsIm5vdGVzIjp7InNjb3BlIjoib3BlbmlkIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgxL2F1dGgvcmVhbG1zL2tleWNsb2FrLWNvcnMiLCJyZXNwb25zZV90eXBlIjoiY29kZSIsInJlZGlyZWN0X3VyaSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC8iLCJzdGF0ZSI6ImJkODEzNzAzLWExMjEtNDc4MC1iOWNmLTkxM2E4MGRlMmE5MSJ9fQ.BOFKHDn-QABw7EY-s7ZuTC2KmH1BuOtcN4ZOKIEcMRo; q_auth=bd813703-a121-4780-b9cf-913a80de2a91
Host: localhost:8081
Origin: http://localhost:8081
Referer: http://localhost:8081/auth/realms/keycloak-cors/protocol/openid-connect/auth?redirect_uri=http%3A%2F%2Flocalhost%3A8080%2F&state=bd813703-a121-4780-b9cf-913a80de2a91&scope=openid&response_type=code&client_id=quarkus
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

Query String parameters:

session_code: qLM9u05m45VTh7CPccgOttumnGO-dv3a6hyAgSt8eXU
execution: 43becedf-17e0-4d09-bfac-85c8c726cf0d
client_id: quarkus
tab_id: 95_tqq_f-gg

Form Data:

username: test
password: test
credentialId:

followed by the following request sequence

General

Request URL: http://localhost:8080/?state=bd813703-a121-4780-b9cf-913a80de2a91&session_state=8fdb1e59-97a5-4b36-a9bf-801649771675&code=ea3c6b21-16c3-4b7d-ae57-659cdede1b44.8fdb1e59-97a5-4b36-a9bf-801649771675.94240a55-7a91-4621-98f2-f4c162f83f78
Request Method: GET
Status Code: 302 Found
Remote Address: [::1]:8080
Referrer Policy: no-referrer-when-downgrade

Response headers:

cache-control: no-store
content-length: 0
location: http://localhost:8080/
Pragma: no-cache
set-cookie: q_session=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJVSUdybTBpN1UwMkV0aDQ4dkpWUFNpVWkyY1VMMXMydE90WkxJc3ZfTTFvIn0.eyJqdGkiOiI0OTVlZWY2Ni00OWRkLTRkNmQtYTcyNC0zNTNkNDk1YWQxNzMiLCJleHAiOjE1OTI5MDk3MTcsIm5iZiI6MCwiaWF0IjoxNTkyOTA5NjU3LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsImF1ZCI6InF1YXJrdXMiLCJzdWIiOiI0YWRkZTJkMC0wMDg1LTQ2MjAtOTcyNS1mN2FjMDAxZmZkOTAiLCJ0eXAiOiJJRCIsImF6cCI6InF1YXJrdXMiLCJhdXRoX3RpbWUiOjE1OTI5MDk2NTcsInNlc3Npb25fc3RhdGUiOiI4ZmRiMWU1OS05N2E1LTRiMzYtYTliZi04MDE2NDk3NzE2NzUiLCJhY3IiOiIxIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0ZXN0In0.Vnm-A-9MnUfrt9iaS7z2oJveCYpKjTIEVHmVdisG9uDapBz7SExc88y_uMmTLJIQ8p5bzlUe_yAo2N0g0L9rsFC1CEoeZH9wc3Zg5RUoqFfpD1nTjTVGTlPanJ_7hM45znLznyAzXjDGz0dHvl1Gt46SQEBUDVYHVi3zDQna6kSU_b1vkmQYkhBtFoEumukR6ab3TcBr_U_hAX0Pk7vwKlAFXi6cAE1bbXZrIKz78FrIsvL_n3L-xnVno1vBQrDkTRtHN9qdRiKMc1AO1UEkvYbuYPrBAp4BpMVJ-aEjL11reuiFtBd_3Mb3nqwYLvFsvuX-m0iVnrW0BrItzGIc6w|eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJVSUdybTBpN1UwMkV0aDQ4dkpWUFNpVWkyY1VMMXMydE90WkxJc3ZfTTFvIn0.eyJqdGkiOiJhNWMwMDgxNC1mZmI3LTQ4MDQtOTAzOC1jZTQ3OGJjYWJhNWUiLCJleHAiOjE1OTI5MDk3MTcsIm5iZiI6MCwiaWF0IjoxNTkyOTA5NjU3LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsImF1ZCI6ImFjY291bnQiLCJzdWIiOiI0YWRkZTJkMC0wMDg1LTQ2MjAtOTcyNS1mN2FjMDAxZmZkOTAiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJxdWFya3VzIiwiYXV0aF90aW1lIjoxNTkyOTA5NjU3LCJzZXNzaW9uX3N0YXRlIjoiOGZkYjFlNTktOTdhNS00YjM2LWE5YmYtODAxNjQ5NzcxNjc1IiwiYWNyIjoiMSIsImFsbG93ZWQtb3JpZ2lucyI6WyJodHRwOi8vbG9jYWxob3N0OjgwODAiXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbIm9mZmxpbmVfYWNjZXNzIiwidW1hX2F1dGhvcml6YXRpb24iXX0sInJlc291cmNlX2FjY2VzcyI6eyJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0ZXN0In0.e7IkCTC2Vh6Ve5LxbDFJrgw09tR_tN1rCm2V8Xzkxrprphi7rK6t_c2C_rhx9W0h-1TzReejHf0acfXYbCIP-33NOgJfH3Gks0Nu7m9Z_Hg0-AukFzU1of3lg7OsnDiEDMLlhAXoG4ZQPeqM46esSZTuBYFGZa1XZUnqRlU_vApdAr8XETT1ulJxCjUCpFC68qNIdqzLobpopyAfoeZRKOEOhCEHgRgc5IL0mmKNd_YLox-645iVLXlj-28MWgCQy0kX5kXoQinkCDKR4JpHVRxxwdWv8UBnMd11mvmehempvf5-scp71V5EtVy6omeHcptZjW5Q4hkjsIWueqdHOQ|eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJqdGkiOiIwMzkxMzVjYy1mYWE0LTQ3ZTItYjU4Ny01MWE3OTAzNjFhNjUiLCJleHAiOjE1OTI5MTE0NTcsIm5iZiI6MCwiaWF0IjoxNTkyOTA5NjU3LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsImF1ZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MS9hdXRoL3JlYWxtcy9rZXljbG9hay1jb3JzIiwic3ViIjoiNGFkZGUyZDAtMDA4NS00NjIwLTk3MjUtZjdhYzAwMWZmZDkwIiwidHlwIjoiUmVmcmVzaCIsImF6cCI6InF1YXJrdXMiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiI4ZmRiMWU1OS05N2E1LTRiMzYtYTliZi04MDE2NDk3NzE2NzUiLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsib2ZmbGluZV9hY2Nlc3MiLCJ1bWFfYXV0aG9yaXphdGlvbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwifQ.kbXS4C-YvsC7EWefzCFAQwH2rjozae5LVNHw37VBFfY; Max-Age=60; Expires=Tue, 23 Jun 2020 10:55:17 GMT; HTTPOnly
set-cookie: q_auth=; Max-Age=0; Expires=Tue, 23 Jun 2020 10:54:17 GMT

Request headers:

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cache-Control: max-age=0
Connection: keep-alive
Cookie: q_auth=bd813703-a121-4780-b9cf-913a80de2a91
Host: localhost:8080
Referer: http://localhost:8081/auth/realms/keycloak-cors/protocol/openid-connect/auth?redirect_uri=http%3A%2F%2Flocalhost%3A8080%2F&state=bd813703-a121-4780-b9cf-913a80de2a91&scope=openid&response_type=code&client_id=quarkus
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

Query String Parameters:

state: bd813703-a121-4780-b9cf-913a80de2a91
session_state: 8fdb1e59-97a5-4b36-a9bf-801649771675
code: ea3c6b21-16c3-4b7d-ae57-659cdede1b44.8fdb1e59-97a5-4b36-a9bf-801649771675.94240a55-7a91-4621-98f2-f4c162f83f78

followed by the following sequence:

General

Request URL: http://localhost:8080/
Request Method: GET
Status Code: 200 OK
Remote Address: [::1]:8080
Referrer Policy: no-referrer-when-downgrade

Response headers:

Accept-Ranges: bytes
Content-Length: 555
Content-Type: text/html;charset=UTF-8
date: Tue, 23 Jun 2020 10:54:17 GMT

Request headers:

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cache-Control: max-age=0
Connection: keep-alive
Cookie: q_session=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJVSUdybTBpN1UwMkV0aDQ4dkpWUFNpVWkyY1VMMXMydE90WkxJc3ZfTTFvIn0.eyJqdGkiOiI0OTVlZWY2Ni00OWRkLTRkNmQtYTcyNC0zNTNkNDk1YWQxNzMiLCJleHAiOjE1OTI5MDk3MTcsIm5iZiI6MCwiaWF0IjoxNTkyOTA5NjU3LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsImF1ZCI6InF1YXJrdXMiLCJzdWIiOiI0YWRkZTJkMC0wMDg1LTQ2MjAtOTcyNS1mN2FjMDAxZmZkOTAiLCJ0eXAiOiJJRCIsImF6cCI6InF1YXJrdXMiLCJhdXRoX3RpbWUiOjE1OTI5MDk2NTcsInNlc3Npb25fc3RhdGUiOiI4ZmRiMWU1OS05N2E1LTRiMzYtYTliZi04MDE2NDk3NzE2NzUiLCJhY3IiOiIxIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0ZXN0In0.Vnm-A-9MnUfrt9iaS7z2oJveCYpKjTIEVHmVdisG9uDapBz7SExc88y_uMmTLJIQ8p5bzlUe_yAo2N0g0L9rsFC1CEoeZH9wc3Zg5RUoqFfpD1nTjTVGTlPanJ_7hM45znLznyAzXjDGz0dHvl1Gt46SQEBUDVYHVi3zDQna6kSU_b1vkmQYkhBtFoEumukR6ab3TcBr_U_hAX0Pk7vwKlAFXi6cAE1bbXZrIKz78FrIsvL_n3L-xnVno1vBQrDkTRtHN9qdRiKMc1AO1UEkvYbuYPrBAp4BpMVJ-aEjL11reuiFtBd_3Mb3nqwYLvFsvuX-m0iVnrW0BrItzGIc6w|eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJVSUdybTBpN1UwMkV0aDQ4dkpWUFNpVWkyY1VMMXMydE90WkxJc3ZfTTFvIn0.eyJqdGkiOiJhNWMwMDgxNC1mZmI3LTQ4MDQtOTAzOC1jZTQ3OGJjYWJhNWUiLCJleHAiOjE1OTI5MDk3MTcsIm5iZiI6MCwiaWF0IjoxNTkyOTA5NjU3LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsImF1ZCI6ImFjY291bnQiLCJzdWIiOiI0YWRkZTJkMC0wMDg1LTQ2MjAtOTcyNS1mN2FjMDAxZmZkOTAiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJxdWFya3VzIiwiYXV0aF90aW1lIjoxNTkyOTA5NjU3LCJzZXNzaW9uX3N0YXRlIjoiOGZkYjFlNTktOTdhNS00YjM2LWE5YmYtODAxNjQ5NzcxNjc1IiwiYWNyIjoiMSIsImFsbG93ZWQtb3JpZ2lucyI6WyJodHRwOi8vbG9jYWxob3N0OjgwODAiXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbIm9mZmxpbmVfYWNjZXNzIiwidW1hX2F1dGhvcml6YXRpb24iXX0sInJlc291cmNlX2FjY2VzcyI6eyJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0ZXN0In0.e7IkCTC2Vh6Ve5LxbDFJrgw09tR_tN1rCm2V8Xzkxrprphi7rK6t_c2C_rhx9W0h-1TzReejHf0acfXYbCIP-33NOgJfH3Gks0Nu7m9Z_Hg0-AukFzU1of3lg7OsnDiEDMLlhAXoG4ZQPeqM46esSZTuBYFGZa1XZUnqRlU_vApdAr8XETT1ulJxCjUCpFC68qNIdqzLobpopyAfoeZRKOEOhCEHgRgc5IL0mmKNd_YLox-645iVLXlj-28MWgCQy0kX5kXoQinkCDKR4JpHVRxxwdWv8UBnMd11mvmehempvf5-scp71V5EtVy6omeHcptZjW5Q4hkjsIWueqdHOQ|eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJqdGkiOiIwMzkxMzVjYy1mYWE0LTQ3ZTItYjU4Ny01MWE3OTAzNjFhNjUiLCJleHAiOjE1OTI5MTE0NTcsIm5iZiI6MCwiaWF0IjoxNTkyOTA5NjU3LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsImF1ZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MS9hdXRoL3JlYWxtcy9rZXljbG9hay1jb3JzIiwic3ViIjoiNGFkZGUyZDAtMDA4NS00NjIwLTk3MjUtZjdhYzAwMWZmZDkwIiwidHlwIjoiUmVmcmVzaCIsImF6cCI6InF1YXJrdXMiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiI4ZmRiMWU1OS05N2E1LTRiMzYtYTliZi04MDE2NDk3NzE2NzUiLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsib2ZmbGluZV9hY2Nlc3MiLCJ1bWFfYXV0aG9yaXphdGlvbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwifQ.kbXS4C-YvsC7EWefzCFAQwH2rjozae5LVNHw37VBFfY
Host: localhost:8080
Referer: http://localhost:8081/auth/realms/keycloak-cors/protocol/openid-connect/auth?redirect_uri=http%3A%2F%2Flocalhost%3A8080%2F&state=bd813703-a121-4780-b9cf-913a80de2a91&scope=openid&response_type=code&client_id=quarkus
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

tomsontom · 2020-06-23T11:14:48Z

If i now rerequest the index.html after the timeout i get the following perfectly fine series of calls:
General:

Request URL: http://localhost:8080/
Request Method: GET
Status Code: 302 Found
Remote Address: [::1]:8080
Referrer Policy: no-referrer-when-downgrade

Response Headers:

content-length: 0
location: http://localhost:8081/auth/realms/keycloak-cors/protocol/openid-connect/auth?redirect_uri=http%3A%2F%2Flocalhost%3A8080%2F&state=f11f08e0-1b3f-44f8-ae7c-14c1e20956b3&scope=openid&response_type=code&client_id=quarkus
set-cookie: q_auth=f11f08e0-1b3f-44f8-ae7c-14c1e20956b3; Max-Age=1800; Expires=Tue, 23 Jun 2020 11:31:51 GMT; HTTPOnly

Request Headers:

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cache-Control: max-age=0
Connection: keep-alive
Host: localhost:8080
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

leading the following call sequence:

General:

Request URL: http://localhost:8081/auth/realms/keycloak-cors/protocol/openid-connect/auth?redirect_uri=http%3A%2F%2Flocalhost%3A8080%2F&state=f11f08e0-1b3f-44f8-ae7c-14c1e20956b3&scope=openid&response_type=code&client_id=quarkus
Request Method: GET
Status Code: 302 Found
Remote Address: [::1]:8081
Referrer Policy: no-referrer-when-downgrade

Response Headers:

Cache-Control: no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 0
Date: Tue, 23 Jun 2020 11:01:51 GMT
Location: http://localhost:8080/?state=f11f08e0-1b3f-44f8-ae7c-14c1e20956b3&session_state=8fdb1e59-97a5-4b36-a9bf-801649771675&code=a744b379-ba3c-40c7-8169-346d96231077.8fdb1e59-97a5-4b36-a9bf-801649771675.94240a55-7a91-4621-98f2-f4c162f83f78
P3P: CP="This is not a P3P policy!"
Set-Cookie: KC_RESTART=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJjaWQiOiJxdWFya3VzIiwicHR5Ijoib3BlbmlkLWNvbm5lY3QiLCJydXJpIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwLyIsImFjdCI6IkFVVEhFTlRJQ0FURSIsIm5vdGVzIjp7InNjb3BlIjoib3BlbmlkIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgxL2F1dGgvcmVhbG1zL2tleWNsb2FrLWNvcnMiLCJyZXNwb25zZV90eXBlIjoiY29kZSIsInJlZGlyZWN0X3VyaSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC8iLCJzdGF0ZSI6ImYxMWYwOGUwLTFiM2YtNDRmOC1hZTdjLTE0YzFlMjA5NTZiMyJ9fQ.2e7CAr65j0qhrWEu4gQIjAub5I6jc0Wgv2ogfe5C7So; Version=1; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KEYCLOAK_LOCALE=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KC_RESTART=; Version=1; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KEYCLOAK_IDENTITY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJqdGkiOiJlNzMwODQxMC03ZmU4LTQ0NWItOTY5ZS1jZTk4ZThkYjI5YTkiLCJleHAiOjE1OTI5NDYxMTEsIm5iZiI6MCwiaWF0IjoxNTkyOTEwMTExLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsInN1YiI6IjRhZGRlMmQwLTAwODUtNDYyMC05NzI1LWY3YWMwMDFmZmQ5MCIsInR5cCI6IlNlcmlhbGl6ZWQtSUQiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiI4ZmRiMWU1OS05N2E1LTRiMzYtYTliZi04MDE2NDk3NzE2NzUiLCJzdGF0ZV9jaGVja2VyIjoiZi13UmpxcFRGS2M4T3BSXzh5bkgyWkx1TzdJXzk3WWwyX2wwbnh3SkhGMCJ9.Kq1dMvzYqVnnwwBZZxAG5QZlV23Dk81JmCqxXyeRu7E; Version=1; Path=/auth/realms/keycloak-cors/; SameSite=None; Secure; HttpOnly
Set-Cookie: KEYCLOAK_IDENTITY_LEGACY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJqdGkiOiJlNzMwODQxMC03ZmU4LTQ0NWItOTY5ZS1jZTk4ZThkYjI5YTkiLCJleHAiOjE1OTI5NDYxMTEsIm5iZiI6MCwiaWF0IjoxNTkyOTEwMTExLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsInN1YiI6IjRhZGRlMmQwLTAwODUtNDYyMC05NzI1LWY3YWMwMDFmZmQ5MCIsInR5cCI6IlNlcmlhbGl6ZWQtSUQiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiI4ZmRiMWU1OS05N2E1LTRiMzYtYTliZi04MDE2NDk3NzE2NzUiLCJzdGF0ZV9jaGVja2VyIjoiZi13UmpxcFRGS2M4T3BSXzh5bkgyWkx1TzdJXzk3WWwyX2wwbnh3SkhGMCJ9.Kq1dMvzYqVnnwwBZZxAG5QZlV23Dk81JmCqxXyeRu7E; Version=1; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KEYCLOAK_SESSION=keycloak-cors/4adde2d0-0085-4620-9725-f7ac001ffd90/8fdb1e59-97a5-4b36-a9bf-801649771675; Version=1; Expires=Tue, 23-Jun-2020 21:01:51 GMT; Max-Age=36000; Path=/auth/realms/keycloak-cors/; SameSite=None; Secure
Set-Cookie: KEYCLOAK_SESSION_LEGACY=keycloak-cors/4adde2d0-0085-4620-9725-f7ac001ffd90/8fdb1e59-97a5-4b36-a9bf-801649771675; Version=1; Expires=Tue, 23-Jun-2020 21:01:51 GMT; Max-Age=36000; Path=/auth/realms/keycloak-cors/
Set-Cookie: KEYCLOAK_REMEMBER_ME=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/keycloak-cors/; HttpOnly

Request Headers:

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cache-Control: max-age=0
Connection: keep-alive
Cookie: AUTH_SESSION_ID=8fdb1e59-97a5-4b36-a9bf-801649771675.0a08cbc5521a; KEYCLOAK_IDENTITY_LEGACY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJqdGkiOiIyNWU1MWFkYy0zMmI3LTQ4YTAtYWM2NC04NWQ0ZTFjNWM4YzgiLCJleHAiOjE1OTI5NDU2NTcsIm5iZiI6MCwiaWF0IjoxNTkyOTA5NjU3LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsInN1YiI6IjRhZGRlMmQwLTAwODUtNDYyMC05NzI1LWY3YWMwMDFmZmQ5MCIsInR5cCI6IlNlcmlhbGl6ZWQtSUQiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiI4ZmRiMWU1OS05N2E1LTRiMzYtYTliZi04MDE2NDk3NzE2NzUiLCJzdGF0ZV9jaGVja2VyIjoiZi13UmpxcFRGS2M4T3BSXzh5bkgyWkx1TzdJXzk3WWwyX2wwbnh3SkhGMCJ9.75-fLkmNlEbQUbQvgbd9nk8mSqhYJSbjwYJ9p25bbP8; KEYCLOAK_SESSION_LEGACY=keycloak-cors/4adde2d0-0085-4620-9725-f7ac001ffd90/8fdb1e59-97a5-4b36-a9bf-801649771675; q_auth=f11f08e0-1b3f-44f8-ae7c-14c1e20956b3
Host: localhost:8081
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

Query String parameters:

redirect_uri: http://localhost:8080/
state: f11f08e0-1b3f-44f8-ae7c-14c1e20956b3
scope: openid
response_type: code
client_id: quarkus

who then leads to the following call:

General:

Request URL: http://localhost:8080/?state=f11f08e0-1b3f-44f8-ae7c-14c1e20956b3&session_state=8fdb1e59-97a5-4b36-a9bf-801649771675&code=a744b379-ba3c-40c7-8169-346d96231077.8fdb1e59-97a5-4b36-a9bf-801649771675.94240a55-7a91-4621-98f2-f4c162f83f78
Request Method: GET
Status Code: 302 Found
Remote Address: [::1]:8080
Referrer Policy: no-referrer-when-downgrade

Response Headers:

cache-control: no-store
content-length: 0
location: http://localhost:8080/
Pragma: no-cache
set-cookie: q_session=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJVSUdybTBpN1UwMkV0aDQ4dkpWUFNpVWkyY1VMMXMydE90WkxJc3ZfTTFvIn0.eyJqdGkiOiI0MDNlZGU3Yy01YTk2LTQyMmYtYjk3NC01MjVlMjUzNzBiOTkiLCJleHAiOjE1OTI5MTAxNzEsIm5iZiI6MCwiaWF0IjoxNTkyOTEwMTExLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsImF1ZCI6InF1YXJrdXMiLCJzdWIiOiI0YWRkZTJkMC0wMDg1LTQ2MjAtOTcyNS1mN2FjMDAxZmZkOTAiLCJ0eXAiOiJJRCIsImF6cCI6InF1YXJrdXMiLCJhdXRoX3RpbWUiOjE1OTI5MDk2NTcsInNlc3Npb25fc3RhdGUiOiI4ZmRiMWU1OS05N2E1LTRiMzYtYTliZi04MDE2NDk3NzE2NzUiLCJhY3IiOiIwIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0ZXN0In0.NJLLUIVVCEp2MzNmklAjK6AOFOlZm-3Z7cQIHK5FLu6mqd5LM7T5ZCdxALKf-ZbPFxDwte4-tj_MlS4NIeq7CWTQb-_NuUmpb3cL-8BdgfN1Nv4Dv0L30ORxnvkoD_BITb3EOLL8FRohEfJx79mePMT9QNpKhrVMcQMm3xCCyMBhrWERsynkzgmZhiVpeovSPxVe_d9sIEj4nCl7gTdFeyYK4TkACocenyNedM37y8IksG38XtZd0s-s1-rteP1MRWRQsGqkCWnB1N_S6jBfgmfta9-8tRb7_serQJ0kXWQos3wZ6baEBk-hpBj4eErXCflMfoXGI_eJgM7BTvBXwg|eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJVSUdybTBpN1UwMkV0aDQ4dkpWUFNpVWkyY1VMMXMydE90WkxJc3ZfTTFvIn0.eyJqdGkiOiIzNjYyNjdiZi1jMDlhLTQ4MTctOWZjZS0xNmNjMTZjOWQ3ZmQiLCJleHAiOjE1OTI5MTAxNzEsIm5iZiI6MCwiaWF0IjoxNTkyOTEwMTExLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsImF1ZCI6ImFjY291bnQiLCJzdWIiOiI0YWRkZTJkMC0wMDg1LTQ2MjAtOTcyNS1mN2FjMDAxZmZkOTAiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJxdWFya3VzIiwiYXV0aF90aW1lIjoxNTkyOTA5NjU3LCJzZXNzaW9uX3N0YXRlIjoiOGZkYjFlNTktOTdhNS00YjM2LWE5YmYtODAxNjQ5NzcxNjc1IiwiYWNyIjoiMCIsImFsbG93ZWQtb3JpZ2lucyI6WyJodHRwOi8vbG9jYWxob3N0OjgwODAiXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbIm9mZmxpbmVfYWNjZXNzIiwidW1hX2F1dGhvcml6YXRpb24iXX0sInJlc291cmNlX2FjY2VzcyI6eyJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0ZXN0In0.buitxjEZJXmx5wUquugTtNzYspcgeyEuKhtMeMVxexma_3BwCu1ntSmopGi_B1u7ctImHtzfDHFdYQpe4dQpC1nSLfWXWc8h2NkHOUQ_r2ta8YJhs7nIclS42MMb6vIP2TRazdjWSfc_NiumGBrjONlD58suj4Y1OBz51b4XSQ_2Z7r0RcH9eCzlY02FO40M1TcCNhyzWhzSmLH6RHJ2odTY4ysKl5EwCL0xjCSImPZk9DqxYPZkG3pmUqeB6UNBnnTfpzMUiYNs2Nt3xjUXpgE8zN2NG_fLNCqQ_jk4BbtBDqn8YiaaBytrEVo-e4fjEX4oTUN9P9Xl_-HMYGPKzg|eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJqdGkiOiI1YWU0ZTBmYi1jYTA1LTQxNjAtOTAyNy03NjEwMjY5MDkyYmMiLCJleHAiOjE1OTI5MTE5MTEsIm5iZiI6MCwiaWF0IjoxNTkyOTEwMTExLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsImF1ZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MS9hdXRoL3JlYWxtcy9rZXljbG9hay1jb3JzIiwic3ViIjoiNGFkZGUyZDAtMDA4NS00NjIwLTk3MjUtZjdhYzAwMWZmZDkwIiwidHlwIjoiUmVmcmVzaCIsImF6cCI6InF1YXJrdXMiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiI4ZmRiMWU1OS05N2E1LTRiMzYtYTliZi04MDE2NDk3NzE2NzUiLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsib2ZmbGluZV9hY2Nlc3MiLCJ1bWFfYXV0aG9yaXphdGlvbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwifQ.WFhBNsRJSJLod5MqpQ-Hk-rQ5CyYOg4G1F_neynOUis; Max-Age=60; Expires=Tue, 23 Jun 2020 11:02:51 GMT; HTTPOnly
set-cookie: q_auth=; Max-Age=0; Expires=Tue, 23 Jun 2020 11:01:51 GMT

Request Headers:

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cache-Control: max-age=0
Connection: keep-alive
Cookie: q_auth=f11f08e0-1b3f-44f8-ae7c-14c1e20956b3
Host: localhost:8080
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

*Query String Parameters:

state: f11f08e0-1b3f-44f8-ae7c-14c1e20956b3
session_state: 8fdb1e59-97a5-4b36-a9bf-801649771675
code: a744b379-ba3c-40c7-8169-346d96231077.8fdb1e59-97a5-4b36-a9bf-801649771675.94240a55-7a91-4621-98f2-f4c162f83f78

finally leading to:

General:

Request URL: http://localhost:8080/
Request Method: GET
Status Code: 200 OK
Remote Address: [::1]:8080
Referrer Policy: no-referrer-when-downgrade

Response Headers:

Accept-Ranges: bytes
Content-Length: 555
Content-Type: text/html;charset=UTF-8
date: Tue, 23 Jun 2020 11:01:51 GMT

Request Headers:

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cache-Control: max-age=0
Connection: keep-alive
Cookie: q_session=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJVSUdybTBpN1UwMkV0aDQ4dkpWUFNpVWkyY1VMMXMydE90WkxJc3ZfTTFvIn0.eyJqdGkiOiI0MDNlZGU3Yy01YTk2LTQyMmYtYjk3NC01MjVlMjUzNzBiOTkiLCJleHAiOjE1OTI5MTAxNzEsIm5iZiI6MCwiaWF0IjoxNTkyOTEwMTExLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsImF1ZCI6InF1YXJrdXMiLCJzdWIiOiI0YWRkZTJkMC0wMDg1LTQ2MjAtOTcyNS1mN2FjMDAxZmZkOTAiLCJ0eXAiOiJJRCIsImF6cCI6InF1YXJrdXMiLCJhdXRoX3RpbWUiOjE1OTI5MDk2NTcsInNlc3Npb25fc3RhdGUiOiI4ZmRiMWU1OS05N2E1LTRiMzYtYTliZi04MDE2NDk3NzE2NzUiLCJhY3IiOiIwIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0ZXN0In0.NJLLUIVVCEp2MzNmklAjK6AOFOlZm-3Z7cQIHK5FLu6mqd5LM7T5ZCdxALKf-ZbPFxDwte4-tj_MlS4NIeq7CWTQb-_NuUmpb3cL-8BdgfN1Nv4Dv0L30ORxnvkoD_BITb3EOLL8FRohEfJx79mePMT9QNpKhrVMcQMm3xCCyMBhrWERsynkzgmZhiVpeovSPxVe_d9sIEj4nCl7gTdFeyYK4TkACocenyNedM37y8IksG38XtZd0s-s1-rteP1MRWRQsGqkCWnB1N_S6jBfgmfta9-8tRb7_serQJ0kXWQos3wZ6baEBk-hpBj4eErXCflMfoXGI_eJgM7BTvBXwg|eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJVSUdybTBpN1UwMkV0aDQ4dkpWUFNpVWkyY1VMMXMydE90WkxJc3ZfTTFvIn0.eyJqdGkiOiIzNjYyNjdiZi1jMDlhLTQ4MTctOWZjZS0xNmNjMTZjOWQ3ZmQiLCJleHAiOjE1OTI5MTAxNzEsIm5iZiI6MCwiaWF0IjoxNTkyOTEwMTExLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsImF1ZCI6ImFjY291bnQiLCJzdWIiOiI0YWRkZTJkMC0wMDg1LTQ2MjAtOTcyNS1mN2FjMDAxZmZkOTAiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJxdWFya3VzIiwiYXV0aF90aW1lIjoxNTkyOTA5NjU3LCJzZXNzaW9uX3N0YXRlIjoiOGZkYjFlNTktOTdhNS00YjM2LWE5YmYtODAxNjQ5NzcxNjc1IiwiYWNyIjoiMCIsImFsbG93ZWQtb3JpZ2lucyI6WyJodHRwOi8vbG9jYWxob3N0OjgwODAiXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbIm9mZmxpbmVfYWNjZXNzIiwidW1hX2F1dGhvcml6YXRpb24iXX0sInJlc291cmNlX2FjY2VzcyI6eyJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0ZXN0In0.buitxjEZJXmx5wUquugTtNzYspcgeyEuKhtMeMVxexma_3BwCu1ntSmopGi_B1u7ctImHtzfDHFdYQpe4dQpC1nSLfWXWc8h2NkHOUQ_r2ta8YJhs7nIclS42MMb6vIP2TRazdjWSfc_NiumGBrjONlD58suj4Y1OBz51b4XSQ_2Z7r0RcH9eCzlY02FO40M1TcCNhyzWhzSmLH6RHJ2odTY4ysKl5EwCL0xjCSImPZk9DqxYPZkG3pmUqeB6UNBnnTfpzMUiYNs2Nt3xjUXpgE8zN2NG_fLNCqQ_jk4BbtBDqn8YiaaBytrEVo-e4fjEX4oTUN9P9Xl_-HMYGPKzg|eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJqdGkiOiI1YWU0ZTBmYi1jYTA1LTQxNjAtOTAyNy03NjEwMjY5MDkyYmMiLCJleHAiOjE1OTI5MTE5MTEsIm5iZiI6MCwiaWF0IjoxNTkyOTEwMTExLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsImF1ZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MS9hdXRoL3JlYWxtcy9rZXljbG9hay1jb3JzIiwic3ViIjoiNGFkZGUyZDAtMDA4NS00NjIwLTk3MjUtZjdhYzAwMWZmZDkwIiwidHlwIjoiUmVmcmVzaCIsImF6cCI6InF1YXJrdXMiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiI4ZmRiMWU1OS05N2E1LTRiMzYtYTliZi04MDE2NDk3NzE2NzUiLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsib2ZmbGluZV9hY2Nlc3MiLCJ1bWFfYXV0aG9yaXphdGlvbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwifQ.WFhBNsRJSJLod5MqpQ-Hk-rQ5CyYOg4G1F_neynOUis
Host: localhost:8080
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

This what I expect and because in that case to Cross-Domain-Request is issued using XHR this does not lead to any problem - the problem is only if the 302 is issued to a XHR request forcing it into calling another host.

tomsontom · 2020-06-23T11:19:35Z

The very same call sequence is work if I enter /hello and keep calling it after the timeout i then get something like this:
General:

Request URL: http://localhost:8080/hello
Request Method: GET
Status Code: 302 Found
Remote Address: [::1]:8080
Referrer Policy: no-referrer-when-downgrade

Response Headers:

content-length: 0
location: http://localhost:8081/auth/realms/keycloak-cors/protocol/openid-connect/auth?redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fhello&state=b8d20100-4557-418a-b983-895330329cc6&scope=openid&response_type=code&client_id=quarkus
set-cookie: q_auth=b8d20100-4557-418a-b983-895330329cc6; Max-Age=1800; Expires=Tue, 23 Jun 2020 11:42:29 GMT; HTTPOnly

Request Headers:

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cache-Control: max-age=0
Connection: keep-alive
Host: localhost:8080
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

leading to:
General:

Request URL: http://localhost:8081/auth/realms/keycloak-cors/protocol/openid-connect/auth?redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fhello&state=b8d20100-4557-418a-b983-895330329cc6&scope=openid&response_type=code&client_id=quarkus
Request Method: GET
Status Code: 302 Found
Remote Address: [::1]:8081
Referrer Policy: no-referrer-when-downgrade

Response Headers:

Cache-Control: no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 0
Date: Tue, 23 Jun 2020 11:12:29 GMT
Location: http://localhost:8080/hello?state=b8d20100-4557-418a-b983-895330329cc6&session_state=a0601754-1c6e-4624-90d9-8c6a079e1542&code=b525b0b7-c834-4aba-9a7d-c037641433da.a0601754-1c6e-4624-90d9-8c6a079e1542.94240a55-7a91-4621-98f2-f4c162f83f78
P3P: CP="This is not a P3P policy!"
Set-Cookie: KC_RESTART=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJjaWQiOiJxdWFya3VzIiwicHR5Ijoib3BlbmlkLWNvbm5lY3QiLCJydXJpIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL2hlbGxvIiwiYWN0IjoiQVVUSEVOVElDQVRFIiwibm90ZXMiOnsic2NvcGUiOiJvcGVuaWQiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwicmVkaXJlY3RfdXJpIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL2hlbGxvIiwic3RhdGUiOiJiOGQyMDEwMC00NTU3LTQxOGEtYjk4My04OTUzMzAzMjljYzYifX0.sDWn6w54uppxNWem4NKAX3hOMen8c9IFeNmY4ONnT88; Version=1; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KEYCLOAK_LOCALE=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KC_RESTART=; Version=1; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KEYCLOAK_IDENTITY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJqdGkiOiI1NGEyNDVlOC02YTE3LTQ5NzAtOWZjYy1lYmJjNzcwN2Q1YmIiLCJleHAiOjE1OTI5NDY3NDksIm5iZiI6MCwiaWF0IjoxNTkyOTEwNzQ5LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsInN1YiI6IjRhZGRlMmQwLTAwODUtNDYyMC05NzI1LWY3YWMwMDFmZmQ5MCIsInR5cCI6IlNlcmlhbGl6ZWQtSUQiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiJhMDYwMTc1NC0xYzZlLTQ2MjQtOTBkOS04YzZhMDc5ZTE1NDIiLCJzdGF0ZV9jaGVja2VyIjoiSGNrQ3BkWEhlNURzRXpqQVZFb29XUFo2b1pUdkFWWEpzQ05RRTdpdzJIayJ9.8gEMKyPpSVRODIv7mHP8-Z8sAEXF-iXZSxHAUanTCKs; Version=1; Path=/auth/realms/keycloak-cors/; SameSite=None; Secure; HttpOnly
Set-Cookie: KEYCLOAK_IDENTITY_LEGACY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJqdGkiOiI1NGEyNDVlOC02YTE3LTQ5NzAtOWZjYy1lYmJjNzcwN2Q1YmIiLCJleHAiOjE1OTI5NDY3NDksIm5iZiI6MCwiaWF0IjoxNTkyOTEwNzQ5LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsInN1YiI6IjRhZGRlMmQwLTAwODUtNDYyMC05NzI1LWY3YWMwMDFmZmQ5MCIsInR5cCI6IlNlcmlhbGl6ZWQtSUQiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiJhMDYwMTc1NC0xYzZlLTQ2MjQtOTBkOS04YzZhMDc5ZTE1NDIiLCJzdGF0ZV9jaGVja2VyIjoiSGNrQ3BkWEhlNURzRXpqQVZFb29XUFo2b1pUdkFWWEpzQ05RRTdpdzJIayJ9.8gEMKyPpSVRODIv7mHP8-Z8sAEXF-iXZSxHAUanTCKs; Version=1; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KEYCLOAK_SESSION=keycloak-cors/4adde2d0-0085-4620-9725-f7ac001ffd90/a0601754-1c6e-4624-90d9-8c6a079e1542; Version=1; Expires=Tue, 23-Jun-2020 21:12:29 GMT; Max-Age=36000; Path=/auth/realms/keycloak-cors/; SameSite=None; Secure
Set-Cookie: KEYCLOAK_SESSION_LEGACY=keycloak-cors/4adde2d0-0085-4620-9725-f7ac001ffd90/a0601754-1c6e-4624-90d9-8c6a079e1542; Version=1; Expires=Tue, 23-Jun-2020 21:12:29 GMT; Max-Age=36000; Path=/auth/realms/keycloak-cors/
Set-Cookie: KEYCLOAK_REMEMBER_ME=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/keycloak-cors/; HttpOnly

Request Headers:

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cache-Control: max-age=0
Connection: keep-alive
Cookie: AUTH_SESSION_ID=a0601754-1c6e-4624-90d9-8c6a079e1542.0a08cbc5521a; KEYCLOAK_IDENTITY_LEGACY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJqdGkiOiI2NDQ0NWZmYy01YTZhLTQ5ZWEtOTZmZC1lNzlmYzVkOTE4ZDAiLCJleHAiOjE1OTI5NDY2NjYsIm5iZiI6MCwiaWF0IjoxNTkyOTEwNjY2LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsInN1YiI6IjRhZGRlMmQwLTAwODUtNDYyMC05NzI1LWY3YWMwMDFmZmQ5MCIsInR5cCI6IlNlcmlhbGl6ZWQtSUQiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiJhMDYwMTc1NC0xYzZlLTQ2MjQtOTBkOS04YzZhMDc5ZTE1NDIiLCJzdGF0ZV9jaGVja2VyIjoiSGNrQ3BkWEhlNURzRXpqQVZFb29XUFo2b1pUdkFWWEpzQ05RRTdpdzJIayJ9.kncyNUE1aF0UKFT1wzlN-AH8AR6V3NAdYcbG2wYG3QI; KEYCLOAK_SESSION_LEGACY=keycloak-cors/4adde2d0-0085-4620-9725-f7ac001ffd90/a0601754-1c6e-4624-90d9-8c6a079e1542; q_auth=b8d20100-4557-418a-b983-895330329cc6
Host: localhost:8081
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

Query String Parameters:

redirect_uri: http://localhost:8080/hello
state: b8d20100-4557-418a-b983-895330329cc6
scope: openid
response_type: code
client_id: quarkus

Leading to:

General:

Request URL: http://localhost:8080/hello?state=b8d20100-4557-418a-b983-895330329cc6&session_state=a0601754-1c6e-4624-90d9-8c6a079e1542&code=b525b0b7-c834-4aba-9a7d-c037641433da.a0601754-1c6e-4624-90d9-8c6a079e1542.94240a55-7a91-4621-98f2-f4c162f83f78
Request Method: GET
Status Code: 302 Found
Remote Address: [::1]:8080
Referrer Policy: no-referrer-when-downgrade

Response Headers:

cache-control: no-store
content-length: 0
location: http://localhost:8080/hello
Pragma: no-cache
set-cookie: q_session=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJVSUdybTBpN1UwMkV0aDQ4dkpWUFNpVWkyY1VMMXMydE90WkxJc3ZfTTFvIn0.eyJqdGkiOiIzNDllYmQwNi05YTE5LTQ3MjktOWEyZC0wM2JhZTljY2Q1ODQiLCJleHAiOjE1OTI5MTA4MDksIm5iZiI6MCwiaWF0IjoxNTkyOTEwNzQ5LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsImF1ZCI6InF1YXJrdXMiLCJzdWIiOiI0YWRkZTJkMC0wMDg1LTQ2MjAtOTcyNS1mN2FjMDAxZmZkOTAiLCJ0eXAiOiJJRCIsImF6cCI6InF1YXJrdXMiLCJhdXRoX3RpbWUiOjE1OTI5MTA2NjYsInNlc3Npb25fc3RhdGUiOiJhMDYwMTc1NC0xYzZlLTQ2MjQtOTBkOS04YzZhMDc5ZTE1NDIiLCJhY3IiOiIwIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0ZXN0In0.VfKP1kMWAgdzp1GIu6_L8T9kuogluOF4DuPSlXv-j03jtRVYGrikDTGQNzkDIqu2OCwaaodfhVBy0llNBitOsogunHjqJy2e0Sjyg3lNp9Acb_oGYbe37djoiu2AD3KfitEdhmCEe6a62l8Pge0DquO83uvpOksE_kTKrGw_xDFTQacATOsdUi9AE-ryD5RExObquSWiP16fig2wkvFVP27ukI_81C_lTYhZnUySMT2HnBsVnrEN1FsWPR-B8AUe59mDK4RcWAmhENRd0KDJ9BlAFRvuZO1U3epQLvg0083zDwWQdxEdAT_0YVIqBlIhWh9RgJmPLps3LgR-RPaWTg|eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJVSUdybTBpN1UwMkV0aDQ4dkpWUFNpVWkyY1VMMXMydE90WkxJc3ZfTTFvIn0.eyJqdGkiOiJiMjQ5NWQ3NS0xZjA0LTQyMzctOWZkNy0zNmE4NjRlZDI3YmEiLCJleHAiOjE1OTI5MTA4MDksIm5iZiI6MCwiaWF0IjoxNTkyOTEwNzQ5LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsImF1ZCI6ImFjY291bnQiLCJzdWIiOiI0YWRkZTJkMC0wMDg1LTQ2MjAtOTcyNS1mN2FjMDAxZmZkOTAiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJxdWFya3VzIiwiYXV0aF90aW1lIjoxNTkyOTEwNjY2LCJzZXNzaW9uX3N0YXRlIjoiYTA2MDE3NTQtMWM2ZS00NjI0LTkwZDktOGM2YTA3OWUxNTQyIiwiYWNyIjoiMCIsImFsbG93ZWQtb3JpZ2lucyI6WyJodHRwOi8vbG9jYWxob3N0OjgwODAiXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbIm9mZmxpbmVfYWNjZXNzIiwidW1hX2F1dGhvcml6YXRpb24iXX0sInJlc291cmNlX2FjY2VzcyI6eyJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0ZXN0In0.E1GRp4LY-6a4ZE7OF__0V0UlpwvMZdxIqUxk36CgOvZwC36EMselh1YEy5yxGvPtDX3c6OYclhr-Op6rASrJxhyQHuF3jtwp8xmxj599A6cJAjaT7DI_ivSFS2DtC6bYre2L8ya0WWcJeCBdEiv28U9en7Q-e47Pt992gs_-UHqlBtdCmdvgfMd2IycMD8JEur-YkhbZgBQWzi6SFRSl0EtTQWnHngK-ixaTnik0f6kibOYmlsCHj33E7spyM3yZiEhchzt-JnStEfgM6LZjpwa0gWk9_sH7YE4106vygl-8sSuhhqeNIrGoudc8JxhmPL5CxZiUonD57FivFODxsg|eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJqdGkiOiIyMWEwMzYxYi03YzIwLTRhNTctYjQ0NC01ODk5NmE3MGIzOTAiLCJleHAiOjE1OTI5MTI1NDksIm5iZiI6MCwiaWF0IjoxNTkyOTEwNzQ5LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsImF1ZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MS9hdXRoL3JlYWxtcy9rZXljbG9hay1jb3JzIiwic3ViIjoiNGFkZGUyZDAtMDA4NS00NjIwLTk3MjUtZjdhYzAwMWZmZDkwIiwidHlwIjoiUmVmcmVzaCIsImF6cCI6InF1YXJrdXMiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiJhMDYwMTc1NC0xYzZlLTQ2MjQtOTBkOS04YzZhMDc5ZTE1NDIiLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsib2ZmbGluZV9hY2Nlc3MiLCJ1bWFfYXV0aG9yaXphdGlvbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwifQ.CZ3uazCeJ7Qli5ZIR4c7mTlX6lZTWAi10an0Q0wQiRk; Max-Age=60; Expires=Tue, 23 Jun 2020 11:13:29 GMT; HTTPOnly
set-cookie: q_auth=; Max-Age=0; Expires=Tue, 23 Jun 2020 11:12:29 GMT

Request Headers:

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cache-Control: max-age=0
Connection: keep-alive
Cookie: q_auth=b8d20100-4557-418a-b983-895330329cc6
Host: localhost:8080
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

Query String Parameters:

state: b8d20100-4557-418a-b983-895330329cc6
session_state: a0601754-1c6e-4624-90d9-8c6a079e1542
code: b525b0b7-c834-4aba-9a7d-c037641433da.a0601754-1c6e-4624-90d9-8c6a079e1542.94240a55-7a91-4621-98f2-f4c162f83f78

finally leading to
General:

Request URL: http://localhost:8080/hello
Request Method: GET
Status Code: 200 OK
Remote Address: [::1]:8080
Referrer Policy: no-referrer-when-downgrade

Response Headers:

Content-Length: 5
Content-Type: text/plain;charset=UTF-8

Request Headers:

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cache-Control: max-age=0
Connection: keep-alive
Cookie: q_session=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJVSUdybTBpN1UwMkV0aDQ4dkpWUFNpVWkyY1VMMXMydE90WkxJc3ZfTTFvIn0.eyJqdGkiOiIzNDllYmQwNi05YTE5LTQ3MjktOWEyZC0wM2JhZTljY2Q1ODQiLCJleHAiOjE1OTI5MTA4MDksIm5iZiI6MCwiaWF0IjoxNTkyOTEwNzQ5LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsImF1ZCI6InF1YXJrdXMiLCJzdWIiOiI0YWRkZTJkMC0wMDg1LTQ2MjAtOTcyNS1mN2FjMDAxZmZkOTAiLCJ0eXAiOiJJRCIsImF6cCI6InF1YXJrdXMiLCJhdXRoX3RpbWUiOjE1OTI5MTA2NjYsInNlc3Npb25fc3RhdGUiOiJhMDYwMTc1NC0xYzZlLTQ2MjQtOTBkOS04YzZhMDc5ZTE1NDIiLCJhY3IiOiIwIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0ZXN0In0.VfKP1kMWAgdzp1GIu6_L8T9kuogluOF4DuPSlXv-j03jtRVYGrikDTGQNzkDIqu2OCwaaodfhVBy0llNBitOsogunHjqJy2e0Sjyg3lNp9Acb_oGYbe37djoiu2AD3KfitEdhmCEe6a62l8Pge0DquO83uvpOksE_kTKrGw_xDFTQacATOsdUi9AE-ryD5RExObquSWiP16fig2wkvFVP27ukI_81C_lTYhZnUySMT2HnBsVnrEN1FsWPR-B8AUe59mDK4RcWAmhENRd0KDJ9BlAFRvuZO1U3epQLvg0083zDwWQdxEdAT_0YVIqBlIhWh9RgJmPLps3LgR-RPaWTg|eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJVSUdybTBpN1UwMkV0aDQ4dkpWUFNpVWkyY1VMMXMydE90WkxJc3ZfTTFvIn0.eyJqdGkiOiJiMjQ5NWQ3NS0xZjA0LTQyMzctOWZkNy0zNmE4NjRlZDI3YmEiLCJleHAiOjE1OTI5MTA4MDksIm5iZiI6MCwiaWF0IjoxNTkyOTEwNzQ5LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsImF1ZCI6ImFjY291bnQiLCJzdWIiOiI0YWRkZTJkMC0wMDg1LTQ2MjAtOTcyNS1mN2FjMDAxZmZkOTAiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJxdWFya3VzIiwiYXV0aF90aW1lIjoxNTkyOTEwNjY2LCJzZXNzaW9uX3N0YXRlIjoiYTA2MDE3NTQtMWM2ZS00NjI0LTkwZDktOGM2YTA3OWUxNTQyIiwiYWNyIjoiMCIsImFsbG93ZWQtb3JpZ2lucyI6WyJodHRwOi8vbG9jYWxob3N0OjgwODAiXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbIm9mZmxpbmVfYWNjZXNzIiwidW1hX2F1dGhvcml6YXRpb24iXX0sInJlc291cmNlX2FjY2VzcyI6eyJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0ZXN0In0.E1GRp4LY-6a4ZE7OF__0V0UlpwvMZdxIqUxk36CgOvZwC36EMselh1YEy5yxGvPtDX3c6OYclhr-Op6rASrJxhyQHuF3jtwp8xmxj599A6cJAjaT7DI_ivSFS2DtC6bYre2L8ya0WWcJeCBdEiv28U9en7Q-e47Pt992gs_-UHqlBtdCmdvgfMd2IycMD8JEur-YkhbZgBQWzi6SFRSl0EtTQWnHngK-ixaTnik0f6kibOYmlsCHj33E7spyM3yZiEhchzt-JnStEfgM6LZjpwa0gWk9_sH7YE4106vygl-8sSuhhqeNIrGoudc8JxhmPL5CxZiUonD57FivFODxsg|eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJqdGkiOiIyMWEwMzYxYi03YzIwLTRhNTctYjQ0NC01ODk5NmE3MGIzOTAiLCJleHAiOjE1OTI5MTI1NDksIm5iZiI6MCwiaWF0IjoxNTkyOTEwNzQ5LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsImF1ZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MS9hdXRoL3JlYWxtcy9rZXljbG9hay1jb3JzIiwic3ViIjoiNGFkZGUyZDAtMDA4NS00NjIwLTk3MjUtZjdhYzAwMWZmZDkwIiwidHlwIjoiUmVmcmVzaCIsImF6cCI6InF1YXJrdXMiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiJhMDYwMTc1NC0xYzZlLTQ2MjQtOTBkOS04YzZhMDc5ZTE1NDIiLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsib2ZmbGluZV9hY2Nlc3MiLCJ1bWFfYXV0aG9yaXphdGlvbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwifQ.CZ3uazCeJ7Qli5ZIR4c7mTlX6lZTWAi10an0Q0wQiRk
Host: localhost:8080
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

tomsontom · 2020-06-23T11:32:48Z

Well now it gets interesting when I compare the response provided by keycloak by invoking "/hello" via the browser I see

Cache-Control: no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 0
Date: Tue, 23 Jun 2020 11:12:29 GMT
Location: http://localhost:8080/hello?state=b8d20100-4557-418a-b983-895330329cc6&session_state=a0601754-1c6e-4624-90d9-8c6a079e1542&code=b525b0b7-c834-4aba-9a7d-c037641433da.a0601754-1c6e-4624-90d9-8c6a079e1542.94240a55-7a91-4621-98f2-f4c162f83f78
P3P: CP="This is not a P3P policy!"
Set-Cookie: KC_RESTART=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJjaWQiOiJxdWFya3VzIiwicHR5Ijoib3BlbmlkLWNvbm5lY3QiLCJydXJpIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL2hlbGxvIiwiYWN0IjoiQVVUSEVOVElDQVRFIiwibm90ZXMiOnsic2NvcGUiOiJvcGVuaWQiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwicmVkaXJlY3RfdXJpIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL2hlbGxvIiwic3RhdGUiOiJiOGQyMDEwMC00NTU3LTQxOGEtYjk4My04OTUzMzAzMjljYzYifX0.sDWn6w54uppxNWem4NKAX3hOMen8c9IFeNmY4ONnT88; Version=1; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KEYCLOAK_LOCALE=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KC_RESTART=; Version=1; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KEYCLOAK_IDENTITY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJqdGkiOiI1NGEyNDVlOC02YTE3LTQ5NzAtOWZjYy1lYmJjNzcwN2Q1YmIiLCJleHAiOjE1OTI5NDY3NDksIm5iZiI6MCwiaWF0IjoxNTkyOTEwNzQ5LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsInN1YiI6IjRhZGRlMmQwLTAwODUtNDYyMC05NzI1LWY3YWMwMDFmZmQ5MCIsInR5cCI6IlNlcmlhbGl6ZWQtSUQiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiJhMDYwMTc1NC0xYzZlLTQ2MjQtOTBkOS04YzZhMDc5ZTE1NDIiLCJzdGF0ZV9jaGVja2VyIjoiSGNrQ3BkWEhlNURzRXpqQVZFb29XUFo2b1pUdkFWWEpzQ05RRTdpdzJIayJ9.8gEMKyPpSVRODIv7mHP8-Z8sAEXF-iXZSxHAUanTCKs; Version=1; Path=/auth/realms/keycloak-cors/; SameSite=None; Secure; HttpOnly
Set-Cookie: KEYCLOAK_IDENTITY_LEGACY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI1NzAwN2IyMS02ZWY4LTRlMTYtOWViNS1jNjQ5MTRhN2ZhZjYifQ.eyJqdGkiOiI1NGEyNDVlOC02YTE3LTQ5NzAtOWZjYy1lYmJjNzcwN2Q1YmIiLCJleHAiOjE1OTI5NDY3NDksIm5iZiI6MCwiaWF0IjoxNTkyOTEwNzQ5LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsInN1YiI6IjRhZGRlMmQwLTAwODUtNDYyMC05NzI1LWY3YWMwMDFmZmQ5MCIsInR5cCI6IlNlcmlhbGl6ZWQtSUQiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiJhMDYwMTc1NC0xYzZlLTQ2MjQtOTBkOS04YzZhMDc5ZTE1NDIiLCJzdGF0ZV9jaGVja2VyIjoiSGNrQ3BkWEhlNURzRXpqQVZFb29XUFo2b1pUdkFWWEpzQ05RRTdpdzJIayJ9.8gEMKyPpSVRODIv7mHP8-Z8sAEXF-iXZSxHAUanTCKs; Version=1; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KEYCLOAK_SESSION=keycloak-cors/4adde2d0-0085-4620-9725-f7ac001ffd90/a0601754-1c6e-4624-90d9-8c6a079e1542; Version=1; Expires=Tue, 23-Jun-2020 21:12:29 GMT; Max-Age=36000; Path=/auth/realms/keycloak-cors/; SameSite=None; Secure
Set-Cookie: KEYCLOAK_SESSION_LEGACY=keycloak-cors/4adde2d0-0085-4620-9725-f7ac001ffd90/a0601754-1c6e-4624-90d9-8c6a079e1542; Version=1; Expires=Tue, 23-Jun-2020 21:12:29 GMT; Max-Age=36000; Path=/auth/realms/keycloak-cors/
Set-Cookie: KEYCLOAK_REMEMBER_ME=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/keycloak-cors/; HttpOnly

When if that happens through an XHR it is:

Cache-Control: no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Language: en
Content-Length: 3089
Content-Security-Policy: frame-src 'self'; frame-ancestors 'self'; object-src 'none';
Content-Type: text/html;charset=utf-8
Date: Tue, 23 Jun 2020 09:06:13 GMT
Set-Cookie: AUTH_SESSION_ID=b2d2fe22-a5ec-4ea7-bcfc-3f248d07ee56.0a08cbc5521a; Version=1; Path=/auth/realms/keycloak-cors-public/; HttpOnly
Set-Cookie: KC_RESTART=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJiZDdkYjg5Yy00NWJkLTQ1MDktODFkMi1lN2IxYjMxYjBhNDYifQ.eyJjaWQiOiJxdWFya3VzIiwicHR5Ijoib3BlbmlkLWNvbm5lY3QiLCJydXJpIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL2hlbGxvIiwiYWN0IjoiQVVUSEVOVElDQVRFIiwibm90ZXMiOnsic2NvcGUiOiJvcGVuaWQiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycy1wdWJsaWMiLCJyZXNwb25zZV90eXBlIjoiY29kZSIsInJlZGlyZWN0X3VyaSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9oZWxsbyIsInN0YXRlIjoiYmEzYmU2N2QtYTE4Yi00YzZmLWFjYjktNmU2MTdjMDU2NzRlIn19.Bj9kuulCAHnH17VjkgpqZUwG21uLObERAOi4rVbtSrE; Version=1; Path=/auth/realms/keycloak-cors-public/; HttpOnly
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Robots-Tag: none
X-XSS-Protection: 1; mode=block

sberyozkin · 2020-06-23T11:38:24Z

Hi @tomsontom
So, if we just drive it via the browser then it is not a problem at all, be it index.html or localhost:8080/hello.
If XHR is involved then it enforces the same origin policy - I think Keycloak has to be configured to enable the CORS.
Does it sound right ? CC @pedroigor

sberyozkin · 2020-06-23T11:40:50Z

@tomsontom Example, mauriciovigolo/keycloak-angular#91, or search for Keycloak CORS. Web Origins field has to be set to http://localhost:8080 most likely

tomsontom · 2020-06-23T11:46:54Z

this is correct but we configured CORS in Keycloak

tomsontom · 2020-06-23T11:48:37Z

we also tried with using "Access Type": Public but that did not change anything

sberyozkin · 2020-06-23T12:07:11Z

@pedroigor Hi Pedro, can you have a look please ? I'm pretty sure now that it is a Keycloak issue. Have a look at the image which @tomsontom attached in the issue description for a summary of the problem.

sberyozkin · 2020-06-23T12:30:56Z

Hi @tomsontom If you are not too tired with tracing it :-), can you please do one more trace with XHR on:

initial index.html pull which causes the login.
index.html after the ID token expiry
(or localhost:8080/hello with XHR).
There is still some grey area, why it works during 1. with XHR

tomsontom · 2020-06-23T12:50:17Z

Not sure I can follow to provide the required information correctly let me rephrase to see if I got this right:

Trace the opening of index.html in the browser (I think that trace is already above)
Trace the opening of index.html after the expire in the browser

our do you want me to rewrite the app the fetch index.html via XHR or how should i initialize a XHR without loading some html/js code. Once I know exactly what you require I'm happy to help get this sorted, and documented for the future developers doing this stuff!

sberyozkin · 2020-06-23T13:15:24Z

@tomsontom sorry, never mind, I think I have a clear picture now of what is going on.
It is just a coincidence that you see the issue for the first time only when the token expires - this is because your very first login does not go via XHR. If your first access to the Quarkus endpoint were going via XHR then you'd see it immediately.
So it is really about getting Keycloak responding with the expected CORS header.

tomsontom · 2020-06-23T14:47:51Z

so one more info: If I turn off CORS in Chrome then everything is working fine so it is definately a client problem

sberyozkin · 2020-06-23T15:51:58Z

@tomsontom Thanks. By the way, what Keycloak version do you use ?

tomsontom · 2020-06-23T16:32:32Z

See https://github.com/tomsontom/keycloak-cors/#environments but locally i also gave 10.0.2 a try without any difference - if time permits in the evening i‘ll put a proxy infront of both and experiment what headers are missing

tomsontom · 2020-06-24T07:21:47Z

So yesterday I hacked into quarkus and added the following headers:

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: *
Access-Control-Allow-Headers: *

But that did not change anything (I already suspected that) adding them to keycloak is a bit trickier so I have not yet done that. As we already suspected this looks like a keycloak problem because it does not send CORS-Headers required to make things work (although we clearly configured them).

I hope I find the time today to hack the Keycloak-Codebase to add those headers to see if that makes a difference - I'd still like to keep this issue open for now

sberyozkin · 2020-06-24T09:42:59Z

Hi @tomsontom Right, CORS headers returned by Quarkus are only needed when the Quarkus resources are accessed (they will likely need to be setup anyway once Keycloak CORS issue is resolved since the user will be getting via XHR back to Quarkus).
It can also make sense to post to the Keycloak forum

sberyozkin · 2020-06-24T09:47:02Z

@tomsontom Can you do a quick try and set the Keycloak web-origin property to http://localhost:8080/, note the trailing / ? Or may be have both http://localhost:8080/ and http://localhost:8080. It might be just an exact match issue...

tomsontom · 2020-06-25T10:57:49Z

So well yesterday I had a looong night and hacked myself into the keycloak codebase and I'm not sure anymore this is a keycloak problem.

The problem as it looks to me is that the request the browser is sending to the keycloak server has not all information and so keycloak in reality responds with the login-page (I can proof that by hacking CORS headers into the response from the endpoint).

I instrumented the keycloak code base as bit and to make things work correctly keycloak exepects the request to contain KEYCLOAK_IDENTITY_LEGACY. .... cookies but those are not present in the failure case:

Auth-Request WRONG:

GET /auth/realms/keycloak-cors/protocol/openid-connect/auth?redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fhello&state=cdfe9c49-225a-48af-b91b-8cd8d0b5cc39&scope=openid&response_type=code&client_id=quarkus HTTP/1.1
Host: localhost:8081
Connection: keep-alive
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Origin: http://localhost:8080
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost:8080/
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7

I don't yet know why but if I turn of websecurity in my chrome the browser is sending the following request:

GET /auth/realms/keycloak-cors/protocol/openid-connect/auth?redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fhello&state=3e1f2d53-a3aa-4f8f-a773-ec10472955fe&scope=openid&response_type=code&client_id=quarkus HTTP/1.1
Host: localhost:8081
Connection: keep-alive
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost:8080/
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: AUTH_SESSION_ID_LEGACY=b14e2c63-6252-4328-b2a7-4f7e58afb17b; KEYCLOAK_SESSION_LEGACY=keycloak-cors/9293584c-b5a6-42a1-ba45-5e1a2c107a03/b14e2c63-6252-4328-b2a7-4f7e58afb17b; KEYCLOAK_IDENTITY_LEGACY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIzMGNiYjNhMC1mMzU2LTRhMjItYjg2MS0xY2QwMGI5YTEzOTIifQ.eyJleHAiOjE1OTMxMTgzMDEsImlhdCI6MTU5MzA4MjMwMSwianRpIjoiNzYyMzhlMGYtNGU0NS00ZDE5LTk5YjktZDBjNWZiOWNjM2U1IiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgxL2F1dGgvcmVhbG1zL2tleWNsb2FrLWNvcnMiLCJzdWIiOiI5MjkzNTg0Yy1iNWE2LTQyYTEtYmE0NS01ZTFhMmMxMDdhMDMiLCJ0eXAiOiJTZXJpYWxpemVkLUlEIiwic2Vzc2lvbl9zdGF0ZSI6ImIxNGUyYzYzLTYyNTItNDMyOC1iMmE3LTRmN2U1OGFmYjE3YiIsInN0YXRlX2NoZWNrZXIiOiJuMkp5cm9XQTF2ZVloRU9ELTZVeXlhVXdma0xWZklnTkRzeFNPcmtVandVIn0.R1zQIwBnAiO1Uhp2mfWdLPdnesnTA_s6MQr-5tIgeLw; q_auth=3e1f2d53-a3aa-4f8f-a773-ec10472955fe

Notice the *_LEGACY-Cookies!?! upon who it responses with

HTTP/1.1 302 Found
Cache-Control: no-store, must-revalidate, max-age=0
Set-Cookie: KC_RESTART=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIzMGNiYjNhMC1mMzU2LTRhMjItYjg2MS0xY2QwMGI5YTEzOTIifQ.eyJjaWQiOiJxdWFya3VzIiwicHR5Ijoib3BlbmlkLWNvbm5lY3QiLCJydXJpIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL2hlbGxvIiwiYWN0IjoiQVVUSEVOVElDQVRFIiwibm90ZXMiOnsic2NvcGUiOiJvcGVuaWQiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODEvYXV0aC9yZWFsbXMva2V5Y2xvYWstY29ycyIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwicmVkaXJlY3RfdXJpIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL2hlbGxvIiwic3RhdGUiOiIzZTFmMmQ1My1hM2FhLTRmOGYtYTc3My1lYzEwNDcyOTU1ZmUifX0.smqsz3T6JzR8ohuYWUKHc6JEr27XqCq_tmYqNGjvL_E; Version=1; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KEYCLOAK_LOCALE=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KC_RESTART=; Version=1; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KEYCLOAK_IDENTITY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIzMGNiYjNhMC1mMzU2LTRhMjItYjg2MS0xY2QwMGI5YTEzOTIifQ.eyJleHAiOjE1OTMxMTgzNjQsImlhdCI6MTU5MzA4MjM2NCwianRpIjoiZjlmNTc1ZjAtMzIzYi00MGFhLWEyNTgtZWExMTBiZGMyM2U0IiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgxL2F1dGgvcmVhbG1zL2tleWNsb2FrLWNvcnMiLCJzdWIiOiI5MjkzNTg0Yy1iNWE2LTQyYTEtYmE0NS01ZTFhMmMxMDdhMDMiLCJ0eXAiOiJTZXJpYWxpemVkLUlEIiwic2Vzc2lvbl9zdGF0ZSI6ImIxNGUyYzYzLTYyNTItNDMyOC1iMmE3LTRmN2U1OGFmYjE3YiIsInN0YXRlX2NoZWNrZXIiOiJuMkp5cm9XQTF2ZVloRU9ELTZVeXlhVXdma0xWZklnTkRzeFNPcmtVandVIn0.QuIK5UFBYX-KF8zyURkVk1c_22aCwzSwjLNXPdWlZf4; Version=1; Path=/auth/realms/keycloak-cors/; SameSite=None; Secure; HttpOnly
Set-Cookie: KEYCLOAK_IDENTITY_LEGACY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIzMGNiYjNhMC1mMzU2LTRhMjItYjg2MS0xY2QwMGI5YTEzOTIifQ.eyJleHAiOjE1OTMxMTgzNjQsImlhdCI6MTU5MzA4MjM2NCwianRpIjoiZjlmNTc1ZjAtMzIzYi00MGFhLWEyNTgtZWExMTBiZGMyM2U0IiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgxL2F1dGgvcmVhbG1zL2tleWNsb2FrLWNvcnMiLCJzdWIiOiI5MjkzNTg0Yy1iNWE2LTQyYTEtYmE0NS01ZTFhMmMxMDdhMDMiLCJ0eXAiOiJTZXJpYWxpemVkLUlEIiwic2Vzc2lvbl9zdGF0ZSI6ImIxNGUyYzYzLTYyNTItNDMyOC1iMmE3LTRmN2U1OGFmYjE3YiIsInN0YXRlX2NoZWNrZXIiOiJuMkp5cm9XQTF2ZVloRU9ELTZVeXlhVXdma0xWZklnTkRzeFNPcmtVandVIn0.QuIK5UFBYX-KF8zyURkVk1c_22aCwzSwjLNXPdWlZf4; Version=1; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KEYCLOAK_SESSION=keycloak-cors/9293584c-b5a6-42a1-ba45-5e1a2c107a03/b14e2c63-6252-4328-b2a7-4f7e58afb17b; Version=1; Expires=Thu, 25-Jun-2020 20:52:44 GMT; Max-Age=36000; Path=/auth/realms/keycloak-cors/; SameSite=None; Secure
Set-Cookie: KEYCLOAK_SESSION_LEGACY=keycloak-cors/9293584c-b5a6-42a1-ba45-5e1a2c107a03/b14e2c63-6252-4328-b2a7-4f7e58afb17b; Version=1; Expires=Thu, 25-Jun-2020 20:52:44 GMT; Max-Age=36000; Path=/auth/realms/keycloak-cors/
Set-Cookie: KEYCLOAK_REMEMBER_ME=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/keycloak-cors/; HttpOnly
P3P: CP="This is not a P3P policy!"
X-XSS-Protection: 1; mode=block
Location: http://localhost:8080/hello?state=3e1f2d53-a3aa-4f8f-a773-ec10472955fe&session_state=b14e2c63-6252-4328-b2a7-4f7e58afb17b&code=5eb031e0-7ff0-4d9a-a08e-60a807e1fa63.b14e2c63-6252-4328-b2a7-4f7e58afb17b.687e6217-909e-4640-8e39-ee5452e700af
Date: Thu, 25 Jun 2020 10:52:44 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Length: 0

Notice the Location-Header - so the question now is: Why is the browser not sending the *_LEGACY-Cookies if I turn on Websecurity.

tomsontom · 2020-06-25T11:06:49Z

Well another interesting datapoint. Those cookies get set in the response to the login-from submission:

Sending of form:

POST /auth/realms/keycloak-cors/login-actions/authenticate?session_code=f9JzgcYNj3n5UJxRVAOv9Nmb_LsYpWn3MO9ZTWPQadA&execution=1cc8efdd-ba70-4fba-bc47-317b367fd67f&client_id=quarkus&tab_id=658LZYn5uh0 HTTP/1.1
Host: localhost:8081
Connection: keep-alive
Content-Length: 41
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost:8081
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost:8081/auth/realms/keycloak-cors/protocol/openid-connect/auth?redirect_uri=http%3A%2F%2Flocalhost%3A8080%2F&state=45a3499e-86a9-4f7f-b46d-d66547b47a59&scope=openid&response_type=code&client_id=quarkus
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: AUTH_SESSION_ID_LEGACY=b90dc4a2-0454-4fef-b4d4-9d7805e15ce0; KC_RESTART=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIzMGNiYjNhMC1mMzU2LTRhMjItYjg2MS0xY2QwMGI5YTEzOTIifQ.eyJjaWQiOiJxdWFya3VzIiwicHR5Ijoib3BlbmlkLWNvbm5lY3QiLCJydXJpIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwLyIsImFjdCI6IkFVVEhFTlRJQ0FURSIsIm5vdGVzIjp7InNjb3BlIjoib3BlbmlkIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgxL2F1dGgvcmVhbG1zL2tleWNsb2FrLWNvcnMiLCJyZXNwb25zZV90eXBlIjoiY29kZSIsInJlZGlyZWN0X3VyaSI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC8iLCJzdGF0ZSI6IjQ1YTM0OTllLTg2YTktNGY3Zi1iNDZkLWQ2NjU0N2I0N2E1OSJ9fQ.fSsjB4mkBkvdAhI-FxV3s9lvEeKxGxNY3PWldT1m888; q_auth=45a3499e-86a9-4f7f-b46d-d66547b47a59

Response:

HTTP/1.1 302 Found
Cache-Control: no-store, must-revalidate, max-age=0
Set-Cookie: KEYCLOAK_LOCALE=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KC_RESTART=; Version=1; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KEYCLOAK_IDENTITY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIzMGNiYjNhMC1mMzU2LTRhMjItYjg2MS0xY2QwMGI5YTEzOTIifQ.eyJleHAiOjE1OTMxMTg4NTcsImlhdCI6MTU5MzA4Mjg1NywianRpIjoiYTA2MGI3YWMtMTZkMS00ZTNmLTk3ZDQtYzk3Y2MxMDZiZTk0IiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgxL2F1dGgvcmVhbG1zL2tleWNsb2FrLWNvcnMiLCJzdWIiOiI5MjkzNTg0Yy1iNWE2LTQyYTEtYmE0NS01ZTFhMmMxMDdhMDMiLCJ0eXAiOiJTZXJpYWxpemVkLUlEIiwic2Vzc2lvbl9zdGF0ZSI6ImI5MGRjNGEyLTA0NTQtNGZlZi1iNGQ0LTlkNzgwNWUxNWNlMCIsInN0YXRlX2NoZWNrZXIiOiJfakxXT2F6bXBiQ2M3aDI4SnRZenB5VmlMeEJPdkR2R1BRZEE3b3RjRHNVIn0.DDdYGzn2F9xNDCMKBLpr4BdDERgypaFjt4LHmE_b0_g; Version=1; Path=/auth/realms/keycloak-cors/; SameSite=None; Secure; HttpOnly
Set-Cookie: KEYCLOAK_IDENTITY_LEGACY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIzMGNiYjNhMC1mMzU2LTRhMjItYjg2MS0xY2QwMGI5YTEzOTIifQ.eyJleHAiOjE1OTMxMTg4NTcsImlhdCI6MTU5MzA4Mjg1NywianRpIjoiYTA2MGI3YWMtMTZkMS00ZTNmLTk3ZDQtYzk3Y2MxMDZiZTk0IiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgxL2F1dGgvcmVhbG1zL2tleWNsb2FrLWNvcnMiLCJzdWIiOiI5MjkzNTg0Yy1iNWE2LTQyYTEtYmE0NS01ZTFhMmMxMDdhMDMiLCJ0eXAiOiJTZXJpYWxpemVkLUlEIiwic2Vzc2lvbl9zdGF0ZSI6ImI5MGRjNGEyLTA0NTQtNGZlZi1iNGQ0LTlkNzgwNWUxNWNlMCIsInN0YXRlX2NoZWNrZXIiOiJfakxXT2F6bXBiQ2M3aDI4SnRZenB5VmlMeEJPdkR2R1BRZEE3b3RjRHNVIn0.DDdYGzn2F9xNDCMKBLpr4BdDERgypaFjt4LHmE_b0_g; Version=1; Path=/auth/realms/keycloak-cors/; HttpOnly
Set-Cookie: KEYCLOAK_SESSION=keycloak-cors/9293584c-b5a6-42a1-ba45-5e1a2c107a03/b90dc4a2-0454-4fef-b4d4-9d7805e15ce0; Version=1; Expires=Thu, 25-Jun-2020 21:00:57 GMT; Max-Age=36000; Path=/auth/realms/keycloak-cors/; SameSite=None; Secure
Set-Cookie: KEYCLOAK_SESSION_LEGACY=keycloak-cors/9293584c-b5a6-42a1-ba45-5e1a2c107a03/b90dc4a2-0454-4fef-b4d4-9d7805e15ce0; Version=1; Expires=Thu, 25-Jun-2020 21:00:57 GMT; Max-Age=36000; Path=/auth/realms/keycloak-cors/
Set-Cookie: KEYCLOAK_REMEMBER_ME=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/keycloak-cors/; HttpOnly
P3P: CP="This is not a P3P policy!"
X-XSS-Protection: 1; mode=block
Location: http://localhost:8080/?state=45a3499e-86a9-4f7f-b46d-d66547b47a59&session_state=b90dc4a2-0454-4fef-b4d4-9d7805e15ce0&code=92bf3321-bff5-493d-8de5-29c7b61301f4.b90dc4a2-0454-4fef-b4d4-9d7805e15ce0.687e6217-909e-4640-8e39-ee5452e700af
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-src 'self'; frame-ancestors 'self'; object-src 'none';
Date: Thu, 25 Jun 2020 11:00:57 GMT
Connection: keep-alive
X-Robots-Tag: none
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Length: 0

tomsontom · 2020-06-25T12:00:35Z

Ok the not sending of the cookie is because one has to turn that on explicitly - we are getting closer!

sberyozkin · 2020-06-25T12:29:36Z

@tomsontom

So well yesterday I had a looong night and hacked myself into the keycloak codebase...

I can imagine it must've taken some time :-)

tomsontom · 2020-06-25T12:36:04Z

i can report success and I can now definately say it is a problem in keycloak. For completeness what had to be done:

Turn on cookie sending with XHR tomsontom/keycloak-cors@c5d49f9
Force keycloak to send the following headers (I hacked that into the codebase):
- Access-Control-Allow-Credentials: true
- access-control-allow-origin: http://localhost:8080

I'm still investigating if there's anything one could pass to make keycloak include them but for the moment it looks like quarkus is doing every correct.

sberyozkin · 2020-06-25T13:09:48Z

@tomsontom This is a very thorough investigation, thanks.
Interesting point from one of your above traces:

Origin: http://localhost:8081

Different port to

access-control-allow-origin: http://localhost:8080

tomsontom · 2020-06-25T13:12:33Z

Well the origin you see is the login-form in keycloak hence the origin is correct!

Keycloak is: 8081
Quarkus is: 8080

sberyozkin · 2020-06-25T13:16:20Z

@tomsontom
I see, thanks. Yeah, please post to the Keycloak forum, they will help you to resolve it. We can keep this issue open and may be we will document some hints once it is resolved.

tomsontom · 2020-06-25T14:37:18Z

so the keycloak post is https://keycloak.discourse.group/t/authorizationendpoint-does-not-support-cors/3495

pedroigor · 2020-06-25T17:14:13Z

@tomsontom sorry for kicking in so late, I've replied to that thread. It is not really a Quarkus issue, neither KC. But something you should handle in your frontend if you really want to stick with that deployment model.

sberyozkin · 2020-06-26T11:28:38Z

Hi @pedroigor
I think we need to have a recommendation on how to use XHR with the Quarkus web-app applications such that it works within the single domain or across the domains.
if we suggest to the users to emded keycloak.js then it immediately becomes a case of the public client accessing Quarkus 'service' applications with the bearer token only which is not great.
If we want to let the users use XHR with web-app applications then I'm not sure we can suggest returning 401/403 instead of the redirect as the script won't be able to create a correct redirect itself.
If we ask the developers to handle the redirect itself, i.e, rewrite the script such that XHR response status is checked, if 302, then redirect manually, etc. then it can become messy, they'd have to retain the cookies (ex, the state one returned from Quarkus, etc)

thanks

tomsontom · 2020-06-26T11:43:18Z

I think suggesting to fix this on the client-side is a none started.

As a frontend application provider I'm not interested if the backend is written in Quarkus, Wildfly, SpringBoot, .net, ... nor am I interested if the backend is deployed in an environment who is protected by Keycloak, SpecialAuthService-X, SpecialAuthService-Y, ... - in an ideal world this is completely transparent to the client.

As already said as long as you are in a single domain all is fine (as long as you know that you need to set the clientCredentials-flag) already today.

pedroigor · 2020-06-26T12:03:45Z

@tomsontom But that is pretty much how OpenID Connect is supposed to work. You would need something like https://openid.net/specs/openid-connect-session-1_0.html to make that work. See the RP iframe part.

In Keycloak, we have a JS adapter that already does that for you, however, the use cases involved are usually the frontend and backend as distinct applications. And your frontend as a client authenticating using some OpenID Provider.

Your frontend does not need to be a Quarkus application at all to make this work. But only served by some web server. The authentication should be done by libraries like Keycloak JS Adapter. Even if you do your frontend served by a Quarkus application, you can just change it to be a "service" type application and use a library like that JS Adapter in your HTMLs. It won't involve quarkus-oidc at all, but just a regular Quarkus application serving a HTML page.

As I said, we could support that on Quarkus by having some config option that could check whether or not the request is a XHR. if so, does not return a 302 but 401 or 403. But again, I'm not sure if this type of deployment is what we would recommend for people. For instance, most of our server-side adapters have support for this behavior but I remember our team not very happy about this capability as it may lead to a wrong design/usage.

pedroigor · 2020-06-26T12:09:38Z

@sberyozkin Exactly, that is why I think a web-app like this one we are discussing is not really a valid usage.

I think that for this case, we don't need quarkus-oidc at all. But just a vanilla Quarkus application serving resources.

sberyozkin · 2020-06-26T12:41:57Z

@pedroigor What about the confidential client support though... With the JS adapter it is no longer a confidential client...

pedroigor · 2020-06-26T13:09:13Z

I'm going to try to implement something on top of that application to show what I'm proposing.

pedroigor · 2020-06-26T14:14:32Z

@sberyozkin @tomsontom Could you check https://github.com/pedroigor/keycloak-cors ?

Basically, what I did was to:

Change app to be a service type application
Use a JS OIDC library so that the frontend can handle all the authentication
Changed the endpoint to listen on /api/hello where access is enforced based on bearer tokens obtained by the frontend

Does it make sense?

pedroigor · 2020-06-26T14:23:09Z

Btw, ideally, the frontend would be a distinct client (public). Where the backend would be a confidential one. I didn't do that to just showcase the changes to the frontend.

pedroigor · 2020-06-26T15:24:18Z

I've also added support for token refresh in that example. So that when the token expires, the token is refreshed without forcing user to re-authenticate.

tomsontom · 2020-06-26T16:01:28Z

Very cool but and I think it might make sense to provide samples of the different solutions (although you said the OpenID solution is nothing you are in favor I still think is a valid solution see below why)

As I outlined already my main concern is that with the client-side solution this application can only be deployed in a keycloak environment, whereas the original frontend application is totally agnostic how and if it is secured by any technology from basic-auth to OpenID to ... .

So as long as I can make sure i can serve all from one domain I'd always go for the initial OID approach because it is much more flexible.

Unfortunately as you made very clear the multi-domain approach won't be supported by Keycloak so I think in the end we could provide 2 flavors:

web-app:
- advantage: client-side is authentification/authorization agnostic and client code is much simpler as one does not have to handle all the token-refrehsing, ...
- disadvantage: keycloak and application need to be served from the same domain (in reality this in a container-env like OpenShift with Ambassador, ... a very common env), more data is transfered on REST calls because cookies are always send with the request
service:
- advantage: keycloak and application can be served from different domains
- disadvantage: client-side code is more complex, client-side code is bound to a specific auth-system

tomsontom · 2020-06-26T16:05:58Z

BTW - I'd be very happy to provide a Guide to Quarkus - https://quarkus.io/guides/ once we aggreed in what should be presented/advertised.

pedroigor · 2020-06-26T16:32:22Z

@tomsontom Good summary.

Very cool but and I think it might make sense to provide samples of the different solutions (although you said the OpenID solution is nothing you are in favor I still think is a valid solution see below why)

I do think it solves the problem. But the use case does not justify having that change, IMO. The main reason being that in the OpenID Connect world you already have the necessary means to solve the same problem.

But this is opensource, let's see if we get more feedback in that discussion, mainly from others in the team.

As I outlined already my main concern is that with the client-side solution this application can only be deployed in a keycloak environment, whereas the original frontend application is totally agnostic how and if it is secured by any technology from basic-auth to OpenID to ... .

I see your point. But once you have a decision to use OpenID you have a set of different authentication methods available.

And you are not tied with Keycloak, but free to use with any JS library that does the same thing as our JS adapter.

So as long as I can make sure i can serve all from one domain I'd always go for the initial OID approach because it is much more flexible.

If the flexibility you mean is in terms of security capabilities, I would say that any OID approach is more flexible.

But if you really, really, want to have one domain as you started this thread, it should still be possible if we all agree that we could have a quarkus.oidc.authentication.redirect-when-xhr=false (probably some better name) config property, that would indicate to your application that for XHR requests responses should be handled just like service type applications (e.g.: 401|403) instead of 302.

I'm not really in favor of adding this until we have more people trying to solve the same problem. But if @sberyozkin thinks this is an option, then I have no objection.

Unfortunately as you made very clear the multi-domain approach won't be supported by Keycloak so I think in the end we could provide 2 flavors:

web-app:

advantage: client-side is authentification/authorization agnostic and client code is much simpler as one does not have to handle all the token-refrehsing, ...

disadvantage: keycloak and application need to be served from the same domain (in reality this in a container-env like OpenShift with Ambassador, ... a very common env), more data is transfered on REST calls because cookies are always send with the request

service:

advantage: keycloak and application can be served from different domains

disadvantage: client-side code is more complex, client-side code is bound to a specific auth-system

I would say that the service approach is what I see most, where the frontend performs all the token dance. In addition to that, ideally, you should also have your backend as a separate client and potentially as a separated application too. In that example I've used the same client in both keycloak.json and quarkus-oidc (which is actually protecting the API) but that is conceptually wrong.

Maybe the idea around that config property helps too?

sberyozkin · 2020-06-26T21:35:59Z

Hi @pedroigor, OK, how will this property help with the web-app and the XHR ? We don't really need a property if we have 'service', right ? thanks

pedroigor · 2020-06-29T11:51:22Z

@sberyozkin It will help so that you don't need to change your app to service as well as not force users to create two distinct clients for both backend (the app serving the content) and the frontend (the SPA). Where we just check whether or not the request is an XHR and return 401|403 instead of 302.

I'm only proposing this approach because it is related to the requirement from @tomsontom where he would like to have all the authentication dance performed by the backend where the frontend will just propagate cookies without having to deal with bearer tokens.

sberyozkin · 2020-07-08T11:34:34Z

Hey Pedro, missed it too, yeah, lets go ahead with quarkus.oidc.authentication.redirect-when-xhr=false, the name reads fine to me. If you can get some time in the next couple of weeks then it would be good, I'm on PTO starting from 27th, have to close a few more issues, lets see how it goes. I guess the trickiest part here is to test it with HtmlUnit :-).

sberyozkin · 2020-07-21T15:05:06Z

@tomsontom FYI, #10651

tomsontom added the kind/bug Something isn't working label Jun 23, 2020

sberyozkin added the area/oidc label Jun 23, 2020

sberyozkin added this to the 1.7.0 - master milestone Jul 8, 2020

boosey mentioned this issue Jul 17, 2020

Oidc Code Flow options for SPA's #10651

Merged

sberyozkin closed this as completed in #10651 Jul 21, 2020

bsteverink mentioned this issue Oct 30, 2020

Session refresh failing during API access mozilla/mozilla-django-oidc#339

Open

CORS Error when Keycloak Token Timesout #10185

CORS Error when Keycloak Token Timesout #10185

Comments

tomsontom commented Jun 23, 2020

sberyozkin commented Jun 23, 2020

sberyozkin commented Jun 23, 2020

sberyozkin commented Jun 23, 2020

tomsontom commented Jun 23, 2020 • edited Loading

sberyozkin commented Jun 23, 2020

tomsontom commented Jun 23, 2020

tomsontom commented Jun 23, 2020

tomsontom commented Jun 23, 2020

tomsontom commented Jun 23, 2020

tomsontom commented Jun 23, 2020

sberyozkin commented Jun 23, 2020

sberyozkin commented Jun 23, 2020 • edited Loading

tomsontom commented Jun 23, 2020

tomsontom commented Jun 23, 2020

sberyozkin commented Jun 23, 2020 • edited Loading

sberyozkin commented Jun 23, 2020 • edited Loading

tomsontom commented Jun 23, 2020

sberyozkin commented Jun 23, 2020 • edited Loading

tomsontom commented Jun 23, 2020

sberyozkin commented Jun 23, 2020

tomsontom commented Jun 23, 2020

tomsontom commented Jun 24, 2020

sberyozkin commented Jun 24, 2020

sberyozkin commented Jun 24, 2020

tomsontom commented Jun 25, 2020 • edited Loading

tomsontom commented Jun 25, 2020

tomsontom commented Jun 25, 2020

sberyozkin commented Jun 25, 2020

tomsontom commented Jun 25, 2020 • edited Loading

sberyozkin commented Jun 25, 2020

tomsontom commented Jun 25, 2020

sberyozkin commented Jun 25, 2020

tomsontom commented Jun 25, 2020

pedroigor commented Jun 25, 2020 • edited Loading

sberyozkin commented Jun 26, 2020

tomsontom commented Jun 26, 2020

pedroigor commented Jun 26, 2020 • edited Loading

pedroigor commented Jun 26, 2020

sberyozkin commented Jun 26, 2020

pedroigor commented Jun 26, 2020

pedroigor commented Jun 26, 2020

pedroigor commented Jun 26, 2020

pedroigor commented Jun 26, 2020

tomsontom commented Jun 26, 2020

tomsontom commented Jun 26, 2020

pedroigor commented Jun 26, 2020 • edited Loading

sberyozkin commented Jun 26, 2020

pedroigor commented Jun 29, 2020

sberyozkin commented Jul 8, 2020

sberyozkin commented Jul 21, 2020

tomsontom commented Jun 23, 2020 •

edited

Loading

sberyozkin commented Jun 23, 2020 •

edited

Loading

sberyozkin commented Jun 23, 2020 •

edited

Loading

sberyozkin commented Jun 23, 2020 •

edited

Loading

sberyozkin commented Jun 23, 2020 •

edited

Loading

tomsontom commented Jun 25, 2020 •

edited

Loading

tomsontom commented Jun 25, 2020 •

edited

Loading

pedroigor commented Jun 25, 2020 •

edited

Loading

pedroigor commented Jun 26, 2020 •

edited

Loading

pedroigor commented Jun 26, 2020 •

edited

Loading