title: keycloak CORS filter spring boot
body: <p>I am using keycloak to secure my rest service. I am refering to the tutorial given <a href="http://slackspace.de/articles/authentication-with-spring-boot-angularjs-and-keycloak/" rel="noreferrer">here</a>. I created the rest and front end. Now when I add keycloak on the backend I get CORS error when my front end makes api call.</p>
  
  <p>Application.java file in spring boot looks like</p>
  
  <pre><code>@SpringBootApplication
  public class Application 
  {
      public static void main( String[] args )
      {
          SpringApplication.run(Application.class, args);
      }
  
      @Bean
      public WebMvcConfigurer corsConfiguration() {
          return new WebMvcConfigurerAdapter() {
              @Override
              public void addCorsMappings(CorsRegistry registry) {
                  registry.addMapping("/api/*")
                          .allowedMethods(HttpMethod.GET.toString(), HttpMethod.POST.toString(),
                                  HttpMethod.PUT.toString(), HttpMethod.DELETE.toString(), HttpMethod.OPTIONS.toString())
                          .allowedOrigins("*");
              }
          };
      }
  } 
  </code></pre>
  
  <p>The keycloak properties in the application.properties file look like</p>
  
  <pre><code>keycloak.realm = demo
  keycloak.auth-server-url = http://localhost:8080/auth
  keycloak.ssl-required = external
  keycloak.resource = tutorial-backend
  keycloak.bearer-only = true
  keycloak.credentials.secret = 123123-1231231-123123-1231
  keycloak.cors = true
  keycloak.securityConstraints[0].securityCollections[0].name = spring secured api
  keycloak.securityConstraints[0].securityCollections[0].authRoles[0] = admin
  keycloak.securityConstraints[0].securityCollections[0].authRoles[1] = user
  keycloak.securityConstraints[0].securityCollections[0].patterns[0] = /api/*
  </code></pre>
  
  <p>The sample REST API  that I am calling</p>
  
  <pre><code>@RestController
  public class SampleController {    
      @RequestMapping(value ="/api/getSample",method=RequestMethod.GET)
      public string home() {
          return new string("demo");
      }        
  }
  </code></pre>
  
  <p>the front end keycloak.json properties include</p>
  
  <pre><code>{
    "realm": "demo",
    "auth-server-url": "http://localhost:8080/auth",
    "ssl-required": "external",
    "resource": "tutorial-frontend",
    "public-client": true
  }
  </code></pre>
  
  <p>The CORS error that I get</p>
  
  <pre><code>XMLHttpRequest cannot load http://localhost:8090/api/getSample. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:9000' is therefore not allowed access. The response had HTTP status code 401.
  </code></pre>