keycloak / keycloak/keycloak-nodejs-connect
Keycloak Auth endpoint sends a 405 Method Not Allowed on Preflight Request
- Dominant language
- JavaScript
- Stars
- 740
- Forks
- 442
- PR merge metrics
- No merged PRs in 30d
Description
### Before reporting an issue
- [X] I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
### Area
adapter/javascript
### Describe the bug
Keycloak returns a 405 Method Not Allowed on an OPTION preflight request after an express server tries to forward an unauthenticated user from the browser to the keycloak login page.
### Version
26.0.5
### Regression
- [ ] The issue is a regression
### Expected behavior
My React frontend sends a request to a secured endpoint in my express proxy. The proxy returns a 302 Found to the frontend. The frontend sends a preflight request that returns the Access-Control-Allow-Origin header and forwards my frontend to the login page.
### Actual behavior
When the preflight request happens the request returns a 405 Method Not Allowed error and lables it as a CORS Missing Allow Origin, since the Access-Control-Allow-Origin header is not returned.
### How to Reproduce?
Send a Get request from a react frontend to a keycloak-connect protected express endpoint.
### Anything else?
_No response_
Contributor guide
Research direction
Start in the adapter/javascript area and reproduce the OPTIONS preflight from a React frontend through the protected Express endpoint. Compare the 405 response with the expected redirect and CORS headers; done means the preflight no longer fails as described.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- express, javascript, react
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100