<p>We are currently facing the following problem for our Webapplication using Keycloak as an IDP behind an Traefik 1.7:</p>
<p>Chrome console tells us:</p>
<pre><code>Access to manifest at 'https://keycloak.dev.example.com/auth/realms/myrealm/protocol/openid-connect/auth?client_id=myclient&amp;redirect_uri=...' (redirected from 'https://myfrontend.dev.example.com/manifest.json') from origin 'https://myfrontend.dev.example.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
</code></pre>
<p>In keycloak we set Web Origins = * for client myclient inside the myrealm realm.</p>
<p>We already tried to set <a href="https://myfrontend.dev.example.com" rel="nofollow noreferrer">https://myfrontend.dev.example.com</a> as the Web Origins. That did not help.</p>
<p>We configured the Ingress inside the namespace where our keycloak is deployed. Adding the annotations:</p>
<pre><code>ingress.kubernetes.io/cors-allow-origin: https://myfrontend.dev.example.com
ingress.kubernetes.io/enable-cors: &quot;true&quot;
</code></pre>
<p>It did not help.</p>
<p>In the past we had a setup with the IDP just using the same subdomain. Of corse this will prevent any CORS issues, but we want to seperate this.</p>
<p>Any suggestions on where to add configuration to apply the CORS-related headers?
Thank you.</p>

Patrick
<p>After some hours of analysis, not understanding what happens here:</p>
<ul>
<li>Setting the Web Origins to * is ok, while I suggest to set it explicitly to the right origins, here: <a href="https://myfrontend.dev.example.com" rel="nofollow noreferrer">https://myfrontend.dev.example.com</a> (without the /* as in Stuck's answer)</li>
<li>If we check the /token endpoint using within an cross-origin request, it works, because the expected response headers are set</li>
<li>BUT: the probleme here occured with the /auth endpoint</li>
</ul>
<p>So, whoever runs into this problem, Keycloak as in 10/2020 with version 11.x does simply not support CORS on the /auth OpenID-connect OIDC endpoint. It is not a requirement from the OIDC specs, so Keycloak (and other tools) do not support CORS here.</p>
<p>If we set the Web Origin and have CORS enable, it will work for some endpoint, e.g. /token, but for some not, e.g. /auth.
This is because /auth is count as a user-only endpoint, a user would explicitly request or a user would be redirected to AND NOT the frontend should somehow send requests in the background to.</p>
<p>We have implemented a wrong workflow inside a part of our application. Not an keycloak (or traefik or kubernetes) problem.</p>
<p>Please check this discussion here for any feature updates:
<a href="https://keycloak.discourse.group/t/authorizationendpoint-does-not-support-cors/3495" rel="nofollow noreferrer">https://keycloak.discourse.group/t/authorizationendpoint-does-not-support-cors/3495</a></p>
