KEYCLOAK-6090 Add missing cors headers with invalid username/password and resource owner grant

services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java

@@ -19,6 +19,7 @@ package org.keycloak.protocol.oidc.endpoints;
 
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.spi.HttpRequest;
+import org.jboss.resteasy.spi.HttpResponse;
 import org.jboss.resteasy.spi.ResteasyProviderFactory;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.OAuthErrorException;
@@ -126,6 +127,9 @@ public class TokenEndpoint {
     @Context
     private HttpRequest request;
 
+    @Context
+    private HttpResponse httpResponse;
+
     @Context
     private HttpHeaders headers;
 
@@ -499,7 +503,10 @@ public class TokenEndpoint {
                 .setUriInfo(uriInfo)
                 .setRequest(request);
         Response challenge = processor.authenticateOnly();
-        if (challenge != null) return challenge;
+        if (challenge != null) {
+            cors.build(httpResponse);
+            return challenge;
+        }
         processor.evaluateRequiredActionTriggers();
         UserModel user = authSession.getAuthenticatedUser();
         if (user.getRequiredActions() != null && user.getRequiredActions().size() > 0) {

testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/util/OAuthClient.java

@@ -382,7 +382,10 @@ public class OAuthClient {
                 post.setHeader("Authorization", authorization);
             } else {
                 parameters.add(new BasicNameValuePair("client_id", clientId));
+            }
 
+            if (origin != null) {
+                post.addHeader("Origin", origin);
             }
 
             if (clientSessionState != null) {

testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenEndpointCorsTest.java

@@ -44,7 +44,7 @@ public class TokenEndpointCorsTest extends AbstractKeycloakTest {
     @Override
     public void addTestRealms(List<RealmRepresentation> testRealms) {
         RealmRepresentation realm = loadJson(getClass().getResourceAsStream("/testrealm.json"), RealmRepresentation.class);
-        realm.getClients().add(ClientBuilder.create().redirectUris(VALID_CORS_URL + "/realms/master/app").addWebOrigin(VALID_CORS_URL).id("test-app2").clientId("test-app2").publicClient().build());
+        realm.getClients().add(ClientBuilder.create().redirectUris(VALID_CORS_URL + "/realms/master/app").addWebOrigin(VALID_CORS_URL).id("test-app2").clientId("test-app2").publicClient().directAccessGrants().build());
         testRealms.add(realm);
     }
 
@@ -97,6 +97,25 @@ public class TokenEndpointCorsTest extends AbstractKeycloakTest {
         assertEquals("Session not active", response.getErrorDescription());
     }
 
+    @Test
+    public void accessTokenResourceOwnerCorsRequest() throws Exception {
+        oauth.realm("test");
+        oauth.clientId("test-app2");
+        oauth.origin(VALID_CORS_URL);
+
+        // Token request
+        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "password");
+
+        assertEquals(200, response.getStatusCode());
+        assertCors(response);
+
+        // Invalid password
+        response = oauth.doGrantAccessTokenRequest("password", "test-user@localhost", "invalid");
+
+        assertEquals(401, response.getStatusCode());
+        assertCors(response);
+    }
+
     private static void assertCors(OAuthClient.AccessTokenResponse response) {
         assertEquals("true", response.getHeaders().get("Access-Control-Allow-Credentials"));
         assertEquals(VALID_CORS_URL, response.getHeaders().get("Access-Control-Allow-Origin"));