Keycloak.js调用loadUserProfile时出现CORS跨域问题求助

我参照官方文档编写了以下脚本连接Keycloak，登录成功后尝试获取用户信息：

<script type="text/javascript" src="http://localhost:8280/js/keycloak.js"></script>
<script type="text/javascript">
  const keycloak = new Keycloak({
    url: 'http://localhost:8280/',
    realm: 'mordor',
    clientId: 'int_accounts-ui'
  });

  keycloak
    .init({
      onLoad: 'check-sso',
      silentCheckSsoRedirectUri: window.location.origin + '/assets/silent-check-sso.html'
    })
    .then(_ => {

      if (!keycloak.authenticated) {
        keycloak.login()
      } else {

        // works
        keycloak.loadUserInfo()
          .then(function (info) {
            console.info("User Info:");
            console.info(info);
          })
          .catch(function () {
            console.error('Failed to load user info');
          });

        // fails with CORS issue
        keycloak.loadUserProfile()
          .then(function (profile) {
            console.info("User Profile:");
            console.info(profile);
          })
          .catch(function () {
            console.error('Failed to load user profile');
          });
      }
    });
</script>

其中keycloak.loadUserInfo调用正常，但keycloak.loadUserProfile触发如下CORS错误：

Access to XMLHttpRequest at 'http://localhost:8280/realms/mordor/account' from origin 'http://localhost:4200' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

已进行的排查操作 #

• 配置客户端开启full scope allowed，也单独配置过view-profile on account角色
• 将客户端的Web Origins设置为+和*
• 尝试过不同版本的keycloak.js，当前使用Keycloak实例自带的版本
• 测试过Chrome、Firefox、Brave等不同浏览器
• 用curl执行失败的请求可以正常返回，但响应中无CORS相关头部：

curl -v 'http://localhost:8280/realms/mordor/account' \
  -H 'Accept: application/json' \
  -H 'Accept-Language: en-US,en;q=0.9,de;q=0.8' \
  -H 'Authorization: bearer eyJhbGciOiJSUzI1NiIsInR5cCIgO...[truncated]' \
  -H 'Cache-Control: no-cache' \
  -H 'Connection: keep-alive' \
  -H 'Origin: http://localhost:4200' \
  -H 'Pragma: no-cache' \
  -H 'Referer: http://localhost:4200/' \
  -H 'Sec-Fetch-Dest: empty' \
  -H 'Sec-Fetch-Mode: cors' \
  -H 'Sec-Fetch-Site: same-site' \
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36' \
  -H 'sec-ch-ua: ".Not/A)Brand";v="99", "Google Chrome";v="103", "Chromium";v="103"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "Linux"' \
  --compressed
*   Trying 127.0.0.1:8280...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 8280 (#0)
> GET /realms/mordor/account HTTP/1.1
> Host: localhost:8280
> Accept-Encoding: deflate, gzip, br
> Accept: application/json
> Accept-Language: en-US,en;q=0.9,de;q=0.8
> Authorization: bearer eyJhbGciOiJSUzI1NiIsInR5cCIgO...[truncated]
> Cache-Control: no-cache
> Connection: keep-alive
> Origin: http://localhost:4200
> Pragma: no-cache
> Referer: http://localhost:4200/
> Sec-Fetch-Dest: empty
> Sec-Fetch-Mode: cors
> Sec-Fetch-Site: same-site
> User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
> sec-ch-ua: ".Not/A)Brand";v="99", "Google Chrome";v="103", "Chromium";v="103"
> sec-ch-ua-mobile: ?0
> sec-ch-ua-platform: "Linux"
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Referrer-Policy: no-referrer
< X-Frame-Options: SAMEORIGIN
< Strict-Transport-Security: max-age=31536000; includeSubDomains
< Cache-Control: no-cache
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Content-Type: application/json
< content-length: 741
< 
* Connection #0 to host localhost left intact
{"id":"1bddfa1f-c840-4439-8435-c4537be62b20","username":"test-account-mgmt","firstName":"Account","lastName":"Mgmt","email":"accountmgmt@mordor","emailVerified":true,"userProfileMetadata":{"attributes":[{"name":"username","displayName":"${username}","required":true,"readOnly":true,"validators":{}},{"name":"email","displayName":"${email}","required":true,"readOnly":false,"validators":{"email":{"ignore.empty.value":true}}},{"name":"firstName","displayName":"${firstName}","required":true,"readOnly":false,"validators":{}},{"name":"lastName","displayName":"${lastName}","required":true,"readOnly":false,"validators":{}}]},"attributes":{"lastImport":["2022-08-30T12:12:05.276620735Z"],"userId":["e32dd0ea-8669-4ec1-a282-aebd9c95fa5a"]}}%  

Keycloak版本：18.0.2（Docker镜像bitnami/keycloak:18）

在提交Bug前，想请教社区还有哪些排查或解决思路？

内容的提问来源于stack exchange，提问作者frank_neff