Uploaded image for project: 'Red Hat build of Keycloak'
  1. Red Hat build of Keycloak
  2. RHBK-2639

Unable to use custom handlers for HTTP OPTIONS method in subresources [GHI#36009]

XMLWordPrintable

    • False
    • Hide

      None

      Show
      None
    • False

      Before reporting an issue

      [X] I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

      Area

      dist/quarkus

      Describe the bug

      Propagated after upgrade to Quarkus 3.15.2 addressed by https://github.com/keycloak/keycloak/issues/35077.

      For Quarkus 3.15.2, some changes around @HEAD, and @OPTIONS handling for sub-resources were made[1]. We are more interested in the @OPTIONS HTTP method that is used in preflight requests. When a sub-resource does not contain REST handler for @OPTIONS, a default response with default fields like 'Access-Control-Allow-Methods' is returned. However, in some places, we managed the @OPTIONS in a method redirecting to the subresource, so RESTEasy was not able to discover it.

      In that case, different headers (from the new default response) were provided, that do not allow some methods hidden in sub-sub-resources.

      It is a breaking change introduced in Quarkus 3.15.2 and addressed by: https://github.com/quarkusio/quarkus/issues/45173

      For instance, the CorsPreflightService is not executed and the default response is returned:

      https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/services/resources/account/AccountLoader.java#L101

      ```

      @Path("{version : v\\d[0-9a-zA-Z_\\-]*}")
      @Produces(MediaType.APPLICATION_JSON)
      public Object getVersionedAccountRestService(final @PathParam("version") String version) {
          if (request.getHttpMethod().equals(HttpMethod.OPTIONS)) {
              return new CorsPreflightService();
          }
          return getAccountRestService(getAccountManagementClient(session.getContext().getRealm()), version);
      }
      

      ```

      The workaround can be removed after upgrading to Quarkus 3.15.3

      Version

      999

      Regression

      [ ] The issue is a regression

      Expected behavior

      Possibility to use OPTIONS handler in sub-resources redirection

      Actual behavior

      Not possible to use OPTIONS handler in sub-resources redirection

      How to Reproduce?

      Send HTTP OPTIONS request to http://keycloak-instance/auth/realms/, or http://keycloak-instance/admin/serverinfo.

      Anything else?

      No response

              Unassigned Unassigned
              pvlha Pavel Vlha
              Keycloak Cloud Native
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: