# Access type confidential causes CORS problems with keycloak.js

**URL:** <https://forum.keycloak.org/t/access-type-confidential-causes-cors-problems-with-keycloak-js/5282>\
**Category:** Securing applications\
**Created:** [October 9, 2020, 12:45pm UTC](https://forum.keycloak.org/t/access-type-confidential-causes-cors-problems-with-keycloak-js/5282 "2020-10-09T12:45:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sveri](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@sveri](https://forum.keycloak.org/u/sveri)\
**Post date:** [October 9, 2020, 12:45pm UTC](https://forum.keycloak.org/t/access-type-confidential-causes-cors-problems-with-keycloak-js/5282/1 "2020-10-09T12:45:24Z")

</div>

Hi,

I created a new client with access type set to “public” and login from my web application using keycloak.js which works, at least with 10.0.  
Now I switched the same setup to access type “confidential” and I get the error that the “Access-Control-Allow-Origin” header is missing.

Keycloak runs in development mode with a self signed cert and my client on localhostin non SSL mode.  
Is that expected to work at all?

If so, what would I have to do? I am running 11.0.2 right now, but can easily switch to a different version if needed.

Thanks,  
Sven

**Edit** So I went through the docs again and the keycloak.js part explicitly states that in the browser only the public setting is expected to work.

---

<div class="post-metadata">

**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\
**Post date:** [October 15, 2020, 8:23pm UTC](https://forum.keycloak.org/t/access-type-confidential-causes-cors-problems-with-keycloak-js/5282/2 "2020-10-15T20:23:00Z")

</div>

You need to have configured `Web Origins` client config properly for confidential OIDC client.