title: Keycloak CORS issue associated with login redirect
body: <p>Similar questions <a href="https://stackoverflow.com/q/46220566/820657">here</a> and <a href="https://stackoverflow.com/q/35953286/820657">here</a> have not helped me resolve the problem.</p>
  
  <p>I am using Keycloak 4.4.0 to secure my REST service, which is implemented using Spring Boot and I am using React for the front end.</p>
  
  <p>I get a CORS error when the front end (running on <code>localhost:3000</code>) makes an API call to <code>localhost:8080/login</code> and is redirected to the Keycloak login page.</p>
  
  <p>The error is:</p>
  
  <blockquote>
    <p>localhost/:1 Failed to load <a href="http://localhost:8080/login" rel="noreferrer">http://localhost:8080/login</a>: Redirect from '<a href="http://localhost:8080/login" rel="noreferrer">http://localhost:8080/login</a>' to '<a href="http://localhost:9080/auth/realms/hbs/protocol/openid-connect/auth?response_type=code&amp;client_id=hbs&amp;redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Flogin&amp;state=ab5034a9-4baa-4be3-9ec1-feefbe5f9c0b&amp;login=true&amp;scope=openid" rel="noreferrer">http://localhost:9080/auth/realms/hbs/protocol/openid-connect/auth?response_type=code&amp;client_id=hbs&amp;redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Flogin&amp;state=ab5034a9-4baa-4be3-9ec1-feefbe5f9c0b&amp;login=true&amp;scope=openid</a>' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '<a href="http://localhost:3000" rel="noreferrer">http://localhost:3000</a>' is therefore not allowed access.</p>
  </blockquote>
  
  <p>I have added a single value of <code>'*'</code> to the <code>Web Origins</code> config section in the Keycloak client.</p>
  
  <p>I have annotated my REST controller as follows:</p>
  
  <pre class="lang-java prettyprint-override"><code>@RestController
  class MyController
  {
      @CrossOrigin
      @GetMapping("/login")
      public ResponseEntity&lt;Foo&gt; getFoo(Principal principal)
      {
          return ResponseEntity.ok(new Foo("blah"));
      }
  }
  </code></pre>
  
  <p>I have enabled Keycloak and CORS in the application properties:</p>
  
  <pre class="lang-java prettyprint-override"><code>keycloak.cors = true
  keycloak.enabled = true
  </code></pre>
  
  <p>If I disable Keycloak and CORS, problem goes away. </p>
  
  <p>As described <a href="https://stackoverflow.com/a/46222250/820657">here</a>, I suspect the issue is to do with the Keycloak server not responding with any <code>Access-Control-Allow-Origin</code> headers despite <code>Web Origins</code> being correctly configured in the Keycloak admin portal. But I'm not completely sure how to confirm this.</p>