mirror of
https://github.com/keycloak/keycloak.git
synced 2026-01-25 16:42:34 +00:00
We now use the allowed WebOrigins configured for the client for which the user info is requested. Previously, Web Origins defined on the Client were not being recognized by the /userinfo endpoint unless you apply the "Allowed Web Origins" protocol mapper. This was an inconsistency with how the Web Origins work compared with the /token endpoint.