diff --git a/upgrading/topics/keycloak/changes.adoc b/upgrading/topics/keycloak/changes.adoc index a5b9d25ac1..08549a0c57 100644 --- a/upgrading/topics/keycloak/changes.adoc +++ b/upgrading/topics/keycloak/changes.adoc @@ -1,5 +1,15 @@ == Migration Changes +=== Migrating to 12.0.2 + +==== Valid Request URIs + +If you use the OpenID Connect parameter `request_uri`, a requirement exists that your client needs to have `Valid Request URIs` configured. +This can be configured through the admin console on the client details page or through the admin REST API or client registration API. Valid Request URIs need +to contain the list of Request URI values, which are permitted for the particular client. This is to avoid SSRF attacks. There is possibility to use wildcards +or relative paths similarly such as the `Valid Redirect URIs` option, however for security purposes, we typically recommend to use as specific value +as possible. + === Migrating to 12.0.0 ==== Upgrade to Wildfly 21