# Keycloak authenticator spi custom response headers

**URL:** <https://forum.keycloak.org/t/keycloak-authenticator-spi-custom-response-headers/7282>\
**Category:** Extending the server\
**Created:** [February 9, 2021, 3:36pm UTC](https://forum.keycloak.org/t/keycloak-authenticator-spi-custom-response-headers/7282 "2021-02-09T15:36:17Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ceejayrao](https://avatars.discourse-cdn.com/v4/letter/c/7bcc69/32.png) [@ceejayrao](https://forum.keycloak.org/u/ceejayrao)\
**Post date:** [February 9, 2021, 3:36pm UTC](https://forum.keycloak.org/t/keycloak-authenticator-spi-custom-response-headers/7282/1 "2021-02-09T15:36:17Z")

</div>

I have implemented access-token-authenticator SPI for browser flow within keycloak server. This authenticator SPI will challenge user to provide access\_token to login. Intended use-case,

- Two applications APP1 and APP2 interact with each other.
- APP1 uses keycloak, however APP2 uses its own authentication.
- Users of APP2 are created in APP1’s keycloak instance with system generated default password, not shared with anyone (intention is never to let that user login to APP1 directly).
- APP2 uses an iframe to launch web page of APP1 for a user.
- Keycloak access-token-authenticator SPI challenges that request with new login form that accepts access\_token.
- APP2 gets an access\_token from APP1’s keycloak instance (APP2 is registered as a client and can impersonate users).
- APP2 sets that access-token into the form and submits.
- access-token-authenticator SPI will validate token and create usermodel for that token on success granting access to the requested resource in APP1.

This flow works fine, however I needed to make a change in realm security defenses,

- X-Frame-Options was set to blank.
- Content-Security-Policy, removed frame-ancestors ‘self’.

I was wondering if this was a safe implementation to remove those response headers? If not, Is there any way to limit these response headers just for this custom access-token-authenticator SPI?

**NOTE:** Tried by adding those response headers in the challenge response object, however they were overwritten by realm settings when present.