From be6a3814fb803fc26751369cd7a162879b3f7dec Mon Sep 17 00:00:00 2001
From: Stian Thorgersen <stianst@gmail.com>
Date: Thu, 30 Oct 2025 12:12:08 +0100
Subject: [PATCH] Add CORS support to OIDC dynamic client registration
 endpoints (#43625)

Closes #8863

Signed-off-by: stianst <stianst@gmail.com>
---
 ...ClientInitialAccessCreatePresentation.java |  11 +
 .../securing-apps/client-registration.adoc    |  12 +
 .../admin/messages/messages_en.properties     |   2 +
 .../CreateInitialAccessToken.tsx              |  20 ++
 .../org/keycloak/http/simple/SimpleHttp.java  |   2 +
 .../http/simple/SimpleHttpMethod.java         |   2 +-
 .../http/simple/SimpleHttpRequest.java        |   2 +
 .../java/org/keycloak/services/cors/Cors.java |   7 +
 .../AbstractClientRegistrationProvider.java   |  15 +-
 .../ClientRegistrationTokenUtils.java         |  25 +-
 .../InitialAccessToken.java                   |  13 +
 .../RegistrationAccessToken.java              |  13 +
 .../oidc/OIDCClientRegistrationProvider.java  |  35 ++-
 .../DefaultClientRegistrationPolicies.java    |   7 +-
 .../impl/RegistrationWebOriginsPolicy.java    |  58 +++++
 .../RegistrationWebOriginsPolicyFactory.java  |  38 +++
 .../keycloak/services/cors/DefaultCors.java   |  32 +++
 .../admin/ClientInitialAccessResource.java    |   2 +-
 .../resources/admin/ClientResource.java       |   2 +-
 ...ion.policy.ClientRegistrationPolicyFactory |   3 +-
 .../testframework/realm/ManagedRealm.java     |  21 ++
 .../OIDCClientRegistrationCorsTest.java       | 223 ++++++++++++++++++
 22 files changed, 520 insertions(+), 25 deletions(-)
 create mode 100644 services/src/main/java/org/keycloak/services/clientregistration/policy/impl/RegistrationWebOriginsPolicy.java
 create mode 100644 services/src/main/java/org/keycloak/services/clientregistration/policy/impl/RegistrationWebOriginsPolicyFactory.java
 create mode 100644 tests/base/src/test/java/org/keycloak/tests/client/OIDCClientRegistrationCorsTest.java

diff --git a/core/src/main/java/org/keycloak/representations/idm/ClientInitialAccessCreatePresentation.java b/core/src/main/java/org/keycloak/representations/idm/ClientInitialAccessCreatePresentation.java
index 27064ec5aa1..7228fb01c31 100644
--- a/core/src/main/java/org/keycloak/representations/idm/ClientInitialAccessCreatePresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/ClientInitialAccessCreatePresentation.java
@@ -17,6 +17,8 @@
 
 package org.keycloak.representations.idm;
 
+import java.util.List;
+
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
@@ -26,6 +28,8 @@ public class ClientInitialAccessCreatePresentation {
 
     private Integer count;
 
+    private List<String> webOrigins;
+
     public ClientInitialAccessCreatePresentation() {
     }
 
@@ -50,4 +54,11 @@ public class ClientInitialAccessCreatePresentation {
         this.count = count;
     }
 
+    public List<String> getWebOrigins() {
+        return webOrigins;
+    }
+
+    public void setWebOrigins(List<String> webOrigins) {
+        this.webOrigins = webOrigins;
+    }
 }
diff --git a/docs/guides/securing-apps/client-registration.adoc b/docs/guides/securing-apps/client-registration.adoc
index 1959eee95bf..6d434d67221 100644
--- a/docs/guides/securing-apps/client-registration.adoc
+++ b/docs/guides/securing-apps/client-registration.adoc
@@ -74,6 +74,18 @@ If a client was created outside of the Client Registration Service it won't have
 You can create one through the admin console. This can also be useful if you lose the token for a particular client.
 To create a new token find the client in the admin console and click on `Credentials`. Then click on `Generate registration access token`.
 
+=== Cross-Origin Resource Sharing (CORS)
+
+In case when clients are registered through the user-agent it is required to configure what web origins are permitted
+for client registration.
+
+For bearer tokens the permitted web origin can be configured in the client the token was issued to. When creating an
+initial access token, the permitted web origins can be supplied directly.
+
+For anonymous access, or as a realm wide configuration, permitted web origins can be configured by going to
+clients, then client registration and updating the `Allowed Registration Web Origins` policy to list web origins
+that should be allowed.
+
 == {project_name} Representations
 
 The `default` client registration provider can be used to create, retrieve, update and delete a client.
diff --git a/js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties b/js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties
index e2e089f709b..f6281aaf385 100644
--- a/js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties
+++ b/js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties
@@ -1,6 +1,8 @@
 cancel=Cancel
 deleteConfirm_other=Are you sure you want to delete these groups?
 trusted-hosts.label=Trusted Hosts
+registration-web-origins.label=Allowed Registration Web Origins
+registration-web-origins.tooltip=Allows CORS requests from the specified web origins
 deletedSuccess=Provider successfully deleted.
 searchAttributes=Search attributes
 userID=User ID
diff --git a/js/apps/admin-ui/src/clients/initial-access/CreateInitialAccessToken.tsx b/js/apps/admin-ui/src/clients/initial-access/CreateInitialAccessToken.tsx
index b9cfab72a03..23135ef3189 100644
--- a/js/apps/admin-ui/src/clients/initial-access/CreateInitialAccessToken.tsx
+++ b/js/apps/admin-ui/src/clients/initial-access/CreateInitialAccessToken.tsx
@@ -3,6 +3,7 @@ import {
   ActionGroup,
   AlertVariant,
   Button,
+  FormGroup,
   PageSection,
 } from "@patternfly/react-core";
 import { useState } from "react";
@@ -18,6 +19,8 @@ import { ViewHeader } from "../../components/view-header/ViewHeader";
 import { useRealm } from "../../context/realm-context/RealmContext";
 import { toClients } from "../routes/Clients";
 import { AccessTokenDialog } from "./AccessTokenDialog";
+import { MultiLineInput } from "../../components/multi-line-input/MultiLineInput";
+import { HelpItem } from "@keycloak/keycloak-ui-shared";
 
 export default function CreateInitialAccessToken() {
   const { adminClient } = useAdminClient();
@@ -91,6 +94,23 @@ export default function CreateInitialAccessToken() {
               defaultValue: 1,
             }}
           />
+          <FormGroup
+            label={t("webOrigins")}
+            fieldId="kc-web-origins"
+            labelIcon={
+              <HelpItem
+                helpText={t("webOriginsHelp")}
+                fieldLabelId="webOrigins"
+              />
+            }
+          >
+            <MultiLineInput
+              id="kc-web-origins"
+              name="webOrigins"
+              aria-label={t("webOrigins")}
+              addButtonLabel="addWebOrigins"
+            />
+          </FormGroup>
           <ActionGroup>
             <Button
               variant="primary"
diff --git a/server-spi-private/src/main/java/org/keycloak/http/simple/SimpleHttp.java b/server-spi-private/src/main/java/org/keycloak/http/simple/SimpleHttp.java
index d13b44c1ec4..23917349ff3 100644
--- a/server-spi-private/src/main/java/org/keycloak/http/simple/SimpleHttp.java
+++ b/server-spi-private/src/main/java/org/keycloak/http/simple/SimpleHttp.java
@@ -66,4 +66,6 @@ public class SimpleHttp {
         return doRequest(url, SimpleHttpMethod.PATCH);
     }
 
+    public SimpleHttpRequest doOptions(String url) { return doRequest(url, SimpleHttpMethod.OPTIONS); }
+
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/http/simple/SimpleHttpMethod.java b/server-spi-private/src/main/java/org/keycloak/http/simple/SimpleHttpMethod.java
index 1d5f12c2298..115c84896dd 100644
--- a/server-spi-private/src/main/java/org/keycloak/http/simple/SimpleHttpMethod.java
+++ b/server-spi-private/src/main/java/org/keycloak/http/simple/SimpleHttpMethod.java
@@ -2,6 +2,6 @@ package org.keycloak.http.simple;
 
 enum SimpleHttpMethod {
 
-    GET, DELETE, HEAD, PUT, PATCH, POST
+    GET, DELETE, HEAD, PUT, PATCH, POST, OPTIONS
 
 }
diff --git a/server-spi-private/src/main/java/org/keycloak/http/simple/SimpleHttpRequest.java b/server-spi-private/src/main/java/org/keycloak/http/simple/SimpleHttpRequest.java
index 5f30b148d71..6023987acbb 100755
--- a/server-spi-private/src/main/java/org/keycloak/http/simple/SimpleHttpRequest.java
+++ b/server-spi-private/src/main/java/org/keycloak/http/simple/SimpleHttpRequest.java
@@ -30,6 +30,7 @@ import org.apache.http.client.methods.HttpDelete;
 import org.apache.http.client.methods.HttpEntityEnclosingRequestBase;
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.client.methods.HttpHead;
+import org.apache.http.client.methods.HttpOptions;
 import org.apache.http.client.methods.HttpPatch;
 import org.apache.http.client.methods.HttpPost;
 import org.apache.http.client.methods.HttpPut;
@@ -201,6 +202,7 @@ public class SimpleHttpRequest {
             case PUT -> new HttpPut(appendParameterToUrl(url));
             case PATCH -> new HttpPatch(appendParameterToUrl(url));
             case POST -> new HttpPost(url);
+            case OPTIONS -> new HttpOptions(url);
         };
     }
 
diff --git a/server-spi-private/src/main/java/org/keycloak/services/cors/Cors.java b/server-spi-private/src/main/java/org/keycloak/services/cors/Cors.java
index 25daf46cfec..71bb375cac8 100755
--- a/server-spi-private/src/main/java/org/keycloak/services/cors/Cors.java
+++ b/server-spi-private/src/main/java/org/keycloak/services/cors/Cors.java
@@ -17,6 +17,7 @@
 
 package org.keycloak.services.cors;
 
+import java.util.List;
 import java.util.concurrent.TimeUnit;
 
 import jakarta.ws.rs.core.Response;
@@ -60,6 +61,8 @@ public interface Cors extends Provider {
 
     Cors auth();
 
+    Cors failOnInvalidOrigin();
+
     Cors allowAllOrigins();
 
     Cors allowedOrigins(KeycloakSession session, ClientModel client);
@@ -68,6 +71,10 @@ public interface Cors extends Provider {
 
     Cors allowedOrigins(String... allowedOrigins);
 
+    Cors allowedOrigins(List<String> allowedOrigins);
+
+    Cors addAllowedOrigins(List<String> allowedOrigins);
+
     Cors allowedMethods(String... allowedMethods);
 
     Cors exposedHeaders(String... exposedHeaders);
diff --git a/services/src/main/java/org/keycloak/services/clientregistration/AbstractClientRegistrationProvider.java b/services/src/main/java/org/keycloak/services/clientregistration/AbstractClientRegistrationProvider.java
index fa0e43b1ac0..ef271b7bb8a 100755
--- a/services/src/main/java/org/keycloak/services/clientregistration/AbstractClientRegistrationProvider.java
+++ b/services/src/main/java/org/keycloak/services/clientregistration/AbstractClientRegistrationProvider.java
@@ -21,6 +21,7 @@ import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.HashSet;
+import java.util.LinkedList;
 import java.util.List;
 import java.util.Objects;
 import java.util.Set;
@@ -40,6 +41,7 @@ import org.keycloak.models.RoleModel;
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.models.utils.RepresentationToModel;
 import org.keycloak.protocol.oidc.OIDCLoginProtocolFactory;
+import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.oidc.OIDCClientRepresentation;
 import org.keycloak.services.ErrorResponseException;
@@ -104,7 +106,7 @@ public abstract class AbstractClientRegistrationProvider implements ClientRegist
 
             client.setSecret(clientModel.getSecret());
 
-            String registrationAccessToken = ClientRegistrationTokenUtils.updateRegistrationAccessToken(session, clientModel, registrationAuth);
+            String registrationAccessToken = ClientRegistrationTokenUtils.updateRegistrationAccessToken(session, clientModel, registrationAuth, getAllowedOrigins());
             client.setRegistrationAccessToken(registrationAccessToken);
 
             if (auth.isInitialAccessToken()) {
@@ -189,7 +191,7 @@ public abstract class AbstractClientRegistrationProvider implements ClientRegist
         if (auth.isRegistrationAccessToken()) {
             String registrationAccessToken;
             if ((boolean) session.getAttribute(ClientRegistrationAccessTokenConstants.ROTATION_ENABLED)) {
-                registrationAccessToken = ClientRegistrationTokenUtils.updateRegistrationAccessToken(session, client, auth.getRegistrationAuth());
+                registrationAccessToken = ClientRegistrationTokenUtils.updateRegistrationAccessToken(session, client, auth.getRegistrationAuth(), getAllowedOrigins());
             } else {
                 registrationAccessToken = ClientRegistrationTokenUtils.updateTokenSignature(session, auth);
             }
@@ -309,4 +311,13 @@ public abstract class AbstractClientRegistrationProvider implements ClientRegist
             client.getRealm().getDefaultRole().removeCompositeRole(client.getRole(defaultRole));
         }
     }
+
+    protected List<String> getAllowedOrigins() {
+        List<String> allowedOrigins = new LinkedList<>();
+        AccessToken jwt = auth.getJwt();
+        if (jwt != null && jwt.getAllowedOrigins() != null) {
+            allowedOrigins.addAll(jwt.getAllowedOrigins());
+        }
+        return allowedOrigins;
+    }
 }
diff --git a/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationTokenUtils.java b/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationTokenUtils.java
index 8236aafff32..20dd47b82a8 100755
--- a/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationTokenUtils.java
+++ b/services/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationTokenUtils.java
@@ -36,6 +36,10 @@ import org.keycloak.services.Urls;
 import org.keycloak.services.clientregistration.policy.RegistrationAuth;
 import org.keycloak.util.TokenUtil;
 
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
@@ -65,23 +69,23 @@ public class ClientRegistrationTokenUtils {
         }
     }
 
-    public static String updateRegistrationAccessToken(KeycloakSession session, ClientModel client, RegistrationAuth registrationAuth) {
-        return updateRegistrationAccessToken(session, session.getContext().getRealm(), client, registrationAuth);
+    public static String updateRegistrationAccessToken(KeycloakSession session, ClientModel client, RegistrationAuth registrationAuth, List<String> webOrigins) {
+        return updateRegistrationAccessToken(session, session.getContext().getRealm(), client, registrationAuth, webOrigins);
     }
 
-    public static String updateRegistrationAccessToken(KeycloakSession session, RealmModel realm, ClientModel client, RegistrationAuth registrationAuth) {
+    public static String updateRegistrationAccessToken(KeycloakSession session, RealmModel realm, ClientModel client, RegistrationAuth registrationAuth, List<String> webOrigins) {
         String id = SecretGenerator.getInstance().generateSecureID();
         client.setRegistrationToken(id);
 
         RegistrationAccessToken regToken = new RegistrationAccessToken();
         regToken.setRegistrationAuth(registrationAuth.toString().toLowerCase());
 
-        return setupToken(regToken, session, realm, id, TYPE_REGISTRATION_ACCESS_TOKEN, 0);
+        return setupToken(regToken, session, realm, id, TYPE_REGISTRATION_ACCESS_TOKEN, 0, webOrigins);
     }
 
-    public static String createInitialAccessToken(KeycloakSession session, RealmModel realm, ClientInitialAccessModel model) {
+    public static String createInitialAccessToken(KeycloakSession session, RealmModel realm, ClientInitialAccessModel model, List<String> webOrigins) {
         InitialAccessToken initialToken = new InitialAccessToken();
-        return setupToken(initialToken, session, realm, model.getId(), TYPE_INITIAL_ACCESS_TOKEN, model.getExpiration() > 0 ? model.getTimestamp() + model.getExpiration() : 0);
+        return setupToken(initialToken, session, realm, model.getId(), TYPE_INITIAL_ACCESS_TOKEN, model.getExpiration() > 0 ? model.getTimestamp() + model.getExpiration() : 0, webOrigins);
     }
 
     public static TokenVerification verifyToken(KeycloakSession session, RealmModel realm, String token) {
@@ -116,7 +120,7 @@ public class ClientRegistrationTokenUtils {
         return TokenVerification.success(kid, jwt);
     }
 
-    private static String setupToken(JsonWebToken jwt, KeycloakSession session, RealmModel realm, String id, String type, long expiration) {
+    private static String setupToken(JsonWebToken jwt, KeycloakSession session, RealmModel realm, String id, String type, long expiration, List<String> webOrigins) {
         String issuer = getIssuer(session, realm);
 
         jwt.type(type);
@@ -126,6 +130,13 @@ public class ClientRegistrationTokenUtils {
         jwt.issuer(issuer);
         jwt.audience(issuer);
 
+        Set<String> webOriginsSet = webOrigins != null ? new HashSet<>(webOrigins) : null;
+        if (jwt instanceof InitialAccessToken) {
+            ((InitialAccessToken) jwt).setAllowedOrigins(webOriginsSet);
+        } else if (jwt instanceof RegistrationAccessToken) {
+            ((RegistrationAccessToken) jwt).setAllowedOrigins(webOriginsSet);
+        }
+
         return session.tokens().encode(jwt);
     }
 
diff --git a/services/src/main/java/org/keycloak/services/clientregistration/InitialAccessToken.java b/services/src/main/java/org/keycloak/services/clientregistration/InitialAccessToken.java
index 6386ccbf669..137403f59f4 100644
--- a/services/src/main/java/org/keycloak/services/clientregistration/InitialAccessToken.java
+++ b/services/src/main/java/org/keycloak/services/clientregistration/InitialAccessToken.java
@@ -17,11 +17,24 @@
 
 package org.keycloak.services.clientregistration;
 
+import com.fasterxml.jackson.annotation.JsonProperty;
 import org.keycloak.representations.JsonWebToken;
 
+import java.util.Set;
+
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
 public class InitialAccessToken extends JsonWebToken {
 
+    @JsonProperty("allowed-origins")
+    protected Set<String> allowedOrigins;
+
+    public Set<String> getAllowedOrigins() {
+        return allowedOrigins;
+    }
+
+    public void setAllowedOrigins(Set<String> allowedOrigins) {
+        this.allowedOrigins = allowedOrigins;
+    }
 }
diff --git a/services/src/main/java/org/keycloak/services/clientregistration/RegistrationAccessToken.java b/services/src/main/java/org/keycloak/services/clientregistration/RegistrationAccessToken.java
index d87ed2770b1..061541e7e82 100644
--- a/services/src/main/java/org/keycloak/services/clientregistration/RegistrationAccessToken.java
+++ b/services/src/main/java/org/keycloak/services/clientregistration/RegistrationAccessToken.java
@@ -20,6 +20,8 @@ package org.keycloak.services.clientregistration;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import org.keycloak.representations.JsonWebToken;
 
+import java.util.Set;
+
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
@@ -30,6 +32,9 @@ public class RegistrationAccessToken extends JsonWebToken {
     @JsonProperty(REGISTRATION_AUTH)
     protected String registrationAuth;
 
+    @JsonProperty("allowed-origins")
+    protected Set<String> allowedOrigins;
+
     public String getRegistrationAuth() {
         return registrationAuth;
     }
@@ -37,4 +42,12 @@ public class RegistrationAccessToken extends JsonWebToken {
     public void setRegistrationAuth(String registrationAuth) {
         this.registrationAuth = registrationAuth;
     }
+
+    public Set<String> getAllowedOrigins() {
+        return allowedOrigins;
+    }
+
+    public void setAllowedOrigins(Set<String> allowedOrigins) {
+        this.allowedOrigins = allowedOrigins;
+    }
 }
diff --git a/services/src/main/java/org/keycloak/services/clientregistration/oidc/OIDCClientRegistrationProvider.java b/services/src/main/java/org/keycloak/services/clientregistration/oidc/OIDCClientRegistrationProvider.java
index 69dfca3e785..a0905255a83 100755
--- a/services/src/main/java/org/keycloak/services/clientregistration/oidc/OIDCClientRegistrationProvider.java
+++ b/services/src/main/java/org/keycloak/services/clientregistration/oidc/OIDCClientRegistrationProvider.java
@@ -16,7 +16,6 @@
  */
 package org.keycloak.services.clientregistration.oidc;
 
-import org.jboss.logging.Logger;
 import org.keycloak.common.util.Time;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.ClientSecretConstants;
@@ -40,10 +39,13 @@ import org.keycloak.services.Urls;
 import org.keycloak.services.clientregistration.AbstractClientRegistrationProvider;
 import org.keycloak.services.clientregistration.ClientRegistrationException;
 import org.keycloak.services.clientregistration.ErrorCodes;
+import org.keycloak.services.cors.Cors;
+import org.keycloak.urls.UrlType;
 
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.DELETE;
 import jakarta.ws.rs.GET;
+import jakarta.ws.rs.OPTIONS;
 import jakarta.ws.rs.POST;
 import jakarta.ws.rs.PUT;
 import jakarta.ws.rs.Path;
@@ -51,7 +53,6 @@ import jakarta.ws.rs.PathParam;
 import jakarta.ws.rs.Produces;
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
-import org.keycloak.urls.UrlType;
 
 import java.net.URI;
 import java.util.ArrayList;
@@ -65,12 +66,21 @@ import java.util.stream.Collectors;
  */
 public class OIDCClientRegistrationProvider extends AbstractClientRegistrationProvider {
 
-    private static final Logger logger = Logger.getLogger(OIDCClientRegistrationProvider.class);
-
     public OIDCClientRegistrationProvider(KeycloakSession session) {
         super(session);
     }
 
+    @OPTIONS
+    public Response preflight() {
+        return Cors.builder().auth().preflight().allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS").add(Response.ok());
+    }
+
+    @OPTIONS
+    @Path("{clientId}")
+    public Response preflightClient() {
+        return preflight();
+    }
+
     @POST
     @Consumes(MediaType.APPLICATION_JSON)
     @Produces(MediaType.APPLICATION_JSON)
@@ -94,7 +104,7 @@ public class OIDCClientRegistrationProvider extends AbstractClientRegistrationPr
             URI uri = getRegistrationClientUri(clientModel);
             clientOIDC = DescriptionConverter.toExternalResponse(session, client, uri);
             clientOIDC.setClientIdIssuedAt(Time.currentTime());
-            return Response.created(uri).entity(clientOIDC).build();
+            return cors().add(Response.created(uri).entity(clientOIDC));
         } catch (ClientRegistrationException cre) {
             ServicesLogger.LOGGER.clientRegistrationException(cre.getMessage());
             throw new ErrorResponseException(ErrorCodes.INVALID_CLIENT_METADATA, "Client metadata invalid", Response.Status.BAD_REQUEST);
@@ -110,7 +120,7 @@ public class OIDCClientRegistrationProvider extends AbstractClientRegistrationPr
         ClientRepresentation clientRepresentation = get(client);
 
         OIDCClientRepresentation clientOIDC = DescriptionConverter.toExternalResponse(session, clientRepresentation, getRegistrationClientUri(client));
-        return Response.ok(clientOIDC).build();
+        return cors().add(Response.ok(clientOIDC));
     }
 
     @PUT
@@ -142,7 +152,7 @@ public class OIDCClientRegistrationProvider extends AbstractClientRegistrationPr
 
             URI uri = getRegistrationClientUri(clientModel);
             clientOIDC = DescriptionConverter.toExternalResponse(session, client, uri);
-            return Response.ok(clientOIDC).build();
+            return cors().add(Response.ok(clientOIDC));
         } catch (ClientRegistrationException cre) {
             ServicesLogger.LOGGER.clientRegistrationException(cre.getMessage());
             throw new ErrorResponseException(ErrorCodes.INVALID_CLIENT_METADATA, "Client metadata invalid", Response.Status.BAD_REQUEST);
@@ -151,8 +161,13 @@ public class OIDCClientRegistrationProvider extends AbstractClientRegistrationPr
 
     @DELETE
     @Path("{clientId}")
-    public void deleteOIDC(@PathParam("clientId") String clientId) {
+    public Response deleteOIDC(@PathParam("clientId") String clientId) {
         delete(clientId);
+        return cors().add(Response.noContent());
+    }
+
+    private Cors cors() {
+        return Cors.builder().failOnInvalidOrigin().auth().addAllowedOrigins(getAllowedOrigins());
     }
 
     private void updatePairwiseSubMappers(ClientModel clientModel, SubjectType subjectType, String sectorIdentifierUri) {
@@ -168,7 +183,7 @@ public class OIDCClientRegistrationProvider extends AbstractClientRegistrationPr
                 } else {
                     return false;
                 }
-            }).collect(Collectors.toList()).forEach((ProtocolMapperModel mapping) -> {
+            }).toList().forEach((ProtocolMapperModel mapping) -> {
                 PairwiseSubMapperHelper.setSectorIdentifierUri(mapping, sectorIdentifierUri);
                 clientModel.updateProtocolMapper(mapping);
             });
@@ -183,7 +198,7 @@ public class OIDCClientRegistrationProvider extends AbstractClientRegistrationPr
             // Rather find and remove all pairwise mappers
             clientModel.getProtocolMappersStream()
                     .filter(mapperRep -> mapperRep.getProtocolMapper().endsWith(AbstractPairwiseSubMapper.PROVIDER_ID_SUFFIX))
-                    .collect(Collectors.toList())
+                    .toList()
                     .forEach(clientModel::removeProtocolMapper);
         }
     }
diff --git a/services/src/main/java/org/keycloak/services/clientregistration/policy/DefaultClientRegistrationPolicies.java b/services/src/main/java/org/keycloak/services/clientregistration/policy/DefaultClientRegistrationPolicies.java
index 6ef2c8d3fd8..073e7410cea 100644
--- a/services/src/main/java/org/keycloak/services/clientregistration/policy/DefaultClientRegistrationPolicies.java
+++ b/services/src/main/java/org/keycloak/services/clientregistration/policy/DefaultClientRegistrationPolicies.java
@@ -34,6 +34,7 @@ import org.keycloak.services.clientregistration.policy.impl.ClientScopesClientRe
 import org.keycloak.services.clientregistration.policy.impl.ConsentRequiredClientRegistrationPolicyFactory;
 import org.keycloak.services.clientregistration.policy.impl.MaxClientsClientRegistrationPolicyFactory;
 import org.keycloak.services.clientregistration.policy.impl.ProtocolMappersClientRegistrationPolicyFactory;
+import org.keycloak.services.clientregistration.policy.impl.RegistrationWebOriginsPolicyFactory;
 import org.keycloak.services.clientregistration.policy.impl.ScopeClientRegistrationPolicyFactory;
 import org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicyFactory;
 
@@ -110,8 +111,10 @@ public class DefaultClientRegistrationPolicies {
         clientTemplatesModel.getConfig().put(ClientScopesClientRegistrationPolicyFactory.ALLOWED_CLIENT_SCOPES, Collections.emptyList());
         clientTemplatesModel.put(ClientScopesClientRegistrationPolicyFactory.ALLOW_DEFAULT_SCOPES, true);
         realm.addComponentModel(clientTemplatesModel);
+
+        ComponentModel allowedRegistrationWebOrigins = createModelInstance("Allowed Registration Web Origins", realm, RegistrationWebOriginsPolicyFactory.PROVIDER_ID, policyTypeKey);
+        allowedRegistrationWebOrigins.getConfig().put(RegistrationWebOriginsPolicyFactory.WEB_ORIGINS, Collections.emptyList());
+        realm.addComponentModel(allowedRegistrationWebOrigins);
     }
 
-
-
 }
diff --git a/services/src/main/java/org/keycloak/services/clientregistration/policy/impl/RegistrationWebOriginsPolicy.java b/services/src/main/java/org/keycloak/services/clientregistration/policy/impl/RegistrationWebOriginsPolicy.java
new file mode 100644
index 00000000000..0b466bf35bb
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/clientregistration/policy/impl/RegistrationWebOriginsPolicy.java
@@ -0,0 +1,58 @@
+package org.keycloak.services.clientregistration.policy.impl;
+
+import org.keycloak.component.ComponentModel;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.services.clientregistration.ClientRegistrationContext;
+import org.keycloak.services.clientregistration.ClientRegistrationProvider;
+import org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy;
+import org.keycloak.services.clientregistration.policy.ClientRegistrationPolicyException;
+import org.keycloak.services.cors.Cors;
+
+import java.util.List;
+
+public class RegistrationWebOriginsPolicy implements ClientRegistrationPolicy {
+
+    private final KeycloakSession session;
+    private final List<String> allowedWebOrigins;
+
+    public RegistrationWebOriginsPolicy(KeycloakSession session, ComponentModel model) {
+        this.session = session;
+        allowedWebOrigins = model.getConfig().getList(RegistrationWebOriginsPolicyFactory.WEB_ORIGINS);
+    }
+
+    @Override
+    public void beforeRegister(ClientRegistrationContext context) throws ClientRegistrationPolicyException {
+        addOrigins();
+    }
+
+    @Override
+    public void afterRegister(ClientRegistrationContext context, ClientModel clientModel) {
+    }
+
+    @Override
+    public void beforeUpdate(ClientRegistrationContext context, ClientModel clientModel) throws ClientRegistrationPolicyException {
+        addOrigins();
+    }
+
+    @Override
+    public void afterUpdate(ClientRegistrationContext context, ClientModel clientModel) {
+    }
+
+    @Override
+    public void beforeView(ClientRegistrationProvider provider, ClientModel clientModel) throws ClientRegistrationPolicyException {
+        addOrigins();
+    }
+
+    @Override
+    public void beforeDelete(ClientRegistrationProvider provider, ClientModel clientModel) throws ClientRegistrationPolicyException {
+        addOrigins();
+    }
+
+    private void addOrigins() {
+        if (allowedWebOrigins != null && !allowedWebOrigins.isEmpty()) {
+            session.getProvider(Cors.class).addAllowedOrigins(allowedWebOrigins);
+        }
+    }
+
+}
diff --git a/services/src/main/java/org/keycloak/services/clientregistration/policy/impl/RegistrationWebOriginsPolicyFactory.java b/services/src/main/java/org/keycloak/services/clientregistration/policy/impl/RegistrationWebOriginsPolicyFactory.java
new file mode 100644
index 00000000000..eb92d5bc654
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/clientregistration/policy/impl/RegistrationWebOriginsPolicyFactory.java
@@ -0,0 +1,38 @@
+package org.keycloak.services.clientregistration.policy.impl;
+
+import org.keycloak.component.ComponentModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.services.clientregistration.policy.AbstractClientRegistrationPolicyFactory;
+import org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy;
+
+import java.util.List;
+
+public class RegistrationWebOriginsPolicyFactory extends AbstractClientRegistrationPolicyFactory {
+
+    public static final String PROVIDER_ID = "registration-web-origins";
+
+    public static final String WEB_ORIGINS = "web-origins";
+
+    private static final ProviderConfigProperty WEB_ORIGINS_PROPERTY = new ProviderConfigProperty(WEB_ORIGINS, "registration-web-origins.label", "registration-web-origins.tooltip", ProviderConfigProperty.MULTIVALUED_STRING_TYPE, null);
+
+    @Override
+    public ClientRegistrationPolicy create(KeycloakSession session, ComponentModel model) {
+        return new RegistrationWebOriginsPolicy(session, model);
+    }
+
+    @Override
+    public String getHelpText() {
+        return "Allowed web origins for client registration requests";
+    }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return List.of(WEB_ORIGINS_PROPERTY);
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+}
diff --git a/services/src/main/java/org/keycloak/services/cors/DefaultCors.java b/services/src/main/java/org/keycloak/services/cors/DefaultCors.java
index ae85a0ee0b0..d41a2edd4d6 100755
--- a/services/src/main/java/org/keycloak/services/cors/DefaultCors.java
+++ b/services/src/main/java/org/keycloak/services/cors/DefaultCors.java
@@ -20,8 +20,10 @@ package org.keycloak.services.cors;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashSet;
+import java.util.List;
 import java.util.Set;
 
+import jakarta.ws.rs.ForbiddenException;
 import jakarta.ws.rs.core.Response.ResponseBuilder;
 
 import org.jboss.logging.Logger;
@@ -51,6 +53,7 @@ public class DefaultCors implements Cors {
 
     private boolean preflight;
     private boolean auth;
+    private boolean failOnInvalidOrigin;
 
     DefaultCors(KeycloakSession session) {
         this.session = session;
@@ -76,6 +79,12 @@ public class DefaultCors implements Cors {
         return this;
     }
 
+    @Override
+    public Cors failOnInvalidOrigin() {
+        failOnInvalidOrigin = true;
+        return this;
+    }
+
     @Override
     public Cors allowAllOrigins() {
         allowedOrigins = Collections.singleton(ACCESS_CONTROL_ALLOW_ORIGIN_WILDCARD);
@@ -106,6 +115,24 @@ public class DefaultCors implements Cors {
         return this;
     }
 
+    @Override
+    public Cors allowedOrigins(List<String> allowedOrigins) {
+        if (allowedOrigins != null && !allowedOrigins.isEmpty()) {
+            this.allowedOrigins = new HashSet<>(allowedOrigins);
+        }
+        return this;
+    }
+
+    @Override
+    public Cors addAllowedOrigins(List<String> allowedOrigins) {
+        if (this.allowedOrigins == null) {
+            this.allowedOrigins = new HashSet<>(allowedOrigins);
+        } else {
+            this.allowedOrigins.addAll(allowedOrigins);
+        }
+        return this;
+    }
+
     @Override
     public Cors allowedMethods(String... allowedMethods) {
         this.allowedMethods = new HashSet<>(Arrays.asList(allowedMethods));
@@ -144,6 +171,11 @@ public class DefaultCors implements Cors {
             if (!origin.equals(requestOrigin) && logger.isDebugEnabled()) {
                 logger.debugv("Invalid CORS request: origin {0} not in allowed origins {1}", origin, allowedOrigins);
             }
+
+            if (failOnInvalidOrigin) {
+                throw new ForbiddenException("Invalid origin");
+            }
+
             return;
         }
 
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ClientInitialAccessResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ClientInitialAccessResource.java
index 6535d20d700..5f26d5383e3 100644
--- a/services/src/main/java/org/keycloak/services/resources/admin/ClientInitialAccessResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ClientInitialAccessResource.java
@@ -102,7 +102,7 @@ public class ClientInitialAccessResource {
 
         ClientInitialAccessPresentation rep = wrap(clientInitialAccessModel);
 
-        String token = ClientRegistrationTokenUtils.createInitialAccessToken(session, realm, clientInitialAccessModel);
+        String token = ClientRegistrationTokenUtils.createInitialAccessToken(session, realm, clientInitialAccessModel, config.getWebOrigins());
         rep.setToken(token);
 
         HttpResponse response = session.getContext().getHttpResponse();
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ClientResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ClientResource.java
index 5ea5ef1b77a..58341c9b487 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/ClientResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ClientResource.java
@@ -325,7 +325,7 @@ public class ClientResource {
     public ClientRepresentation regenerateRegistrationAccessToken() {
         auth.clients().requireManage(client);
 
-        String token = ClientRegistrationTokenUtils.updateRegistrationAccessToken(session, realm, client, RegistrationAuth.AUTHENTICATED);
+        String token = ClientRegistrationTokenUtils.updateRegistrationAccessToken(session, realm, client, RegistrationAuth.AUTHENTICATED, null);
 
         ClientRepresentation rep = ModelToRepresentation.toRepresentation(client, session);
         rep.setRegistrationAccessToken(token);
diff --git a/services/src/main/resources/META-INF/services/org.keycloak.services.clientregistration.policy.ClientRegistrationPolicyFactory b/services/src/main/resources/META-INF/services/org.keycloak.services.clientregistration.policy.ClientRegistrationPolicyFactory
index 5b3a11ff97a..a79b0bfa3f5 100644
--- a/services/src/main/resources/META-INF/services/org.keycloak.services.clientregistration.policy.ClientRegistrationPolicyFactory
+++ b/services/src/main/resources/META-INF/services/org.keycloak.services.clientregistration.policy.ClientRegistrationPolicyFactory
@@ -21,4 +21,5 @@ org.keycloak.services.clientregistration.policy.impl.ProtocolMappersClientRegist
 org.keycloak.services.clientregistration.policy.impl.ClientScopesClientRegistrationPolicyFactory
 org.keycloak.services.clientregistration.policy.impl.ScopeClientRegistrationPolicyFactory
 org.keycloak.services.clientregistration.policy.impl.ClientDisabledClientRegistrationPolicyFactory
-org.keycloak.services.clientregistration.policy.impl.MaxClientsClientRegistrationPolicyFactory
\ No newline at end of file
+org.keycloak.services.clientregistration.policy.impl.MaxClientsClientRegistrationPolicyFactory
+org.keycloak.services.clientregistration.policy.impl.RegistrationWebOriginsPolicyFactory
\ No newline at end of file
diff --git a/test-framework/core/src/main/java/org/keycloak/testframework/realm/ManagedRealm.java b/test-framework/core/src/main/java/org/keycloak/testframework/realm/ManagedRealm.java
index 857be6676fb..25b5fca19a4 100644
--- a/test-framework/core/src/main/java/org/keycloak/testframework/realm/ManagedRealm.java
+++ b/test-framework/core/src/main/java/org/keycloak/testframework/realm/ManagedRealm.java
@@ -1,7 +1,9 @@
 package org.keycloak.testframework.realm;
 
+import org.keycloak.admin.client.resource.ComponentResource;
 import org.keycloak.admin.client.resource.IdentityProviderResource;
 import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.representations.idm.ComponentRepresentation;
 import org.keycloak.representations.idm.IdentityProviderRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 import org.keycloak.testframework.injection.ManagedTestResource;
@@ -69,6 +71,17 @@ public class ManagedRealm extends ManagedTestResource {
         cleanup().add(r -> r.identityProviders().get(alias).update(original));
     }
 
+    public void updateComponentWithCleanup(String id, ComponentUpdate update) {
+        ComponentResource componentResource = realmResource.components().component(id);
+
+        ComponentRepresentation original = componentResource.toRepresentation();
+        ComponentRepresentation updated = RepresentationUtils.clone(original);
+        update.update(updated);
+        componentResource.update(updated);
+
+        cleanup().add(r -> r.components().component(id).update(original));
+    }
+
     public ManagedRealmCleanup cleanup() {
         if (cleanup == null) {
             cleanup = new ManagedRealmCleanup();
@@ -96,4 +109,12 @@ public class ManagedRealm extends ManagedTestResource {
 
     }
 
+    public interface ComponentUpdate {
+
+        void update(ComponentRepresentation rep);
+
+    }
+
+
+
 }
diff --git a/tests/base/src/test/java/org/keycloak/tests/client/OIDCClientRegistrationCorsTest.java b/tests/base/src/test/java/org/keycloak/tests/client/OIDCClientRegistrationCorsTest.java
new file mode 100644
index 00000000000..433168ee0e3
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/client/OIDCClientRegistrationCorsTest.java
@@ -0,0 +1,223 @@
+package org.keycloak.tests.client;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.keycloak.admin.client.CreatedResponseUtil;
+import org.keycloak.http.simple.SimpleHttp;
+import org.keycloak.http.simple.SimpleHttpRequest;
+import org.keycloak.http.simple.SimpleHttpResponse;
+import org.keycloak.representations.idm.ClientInitialAccessCreatePresentation;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.ComponentRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.oidc.OIDCClientRepresentation;
+import org.keycloak.services.clientregistration.RegistrationAccessToken;
+import org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy;
+import org.keycloak.services.clientregistration.policy.impl.RegistrationWebOriginsPolicyFactory;
+import org.keycloak.services.clientregistration.policy.impl.TrustedHostClientRegistrationPolicyFactory;
+import org.keycloak.testframework.annotations.InjectRealm;
+import org.keycloak.testframework.annotations.InjectSimpleHttp;
+import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.testframework.oauth.OAuthClient;
+import org.keycloak.testframework.oauth.annotations.InjectOAuthClient;
+import org.keycloak.testframework.realm.ClientConfigBuilder;
+import org.keycloak.testframework.realm.ManagedRealm;
+
+import jakarta.ws.rs.core.Response;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Optional;
+import java.util.stream.Collectors;
+
+@KeycloakIntegrationTest
+public class OIDCClientRegistrationCorsTest {
+
+    @InjectRealm
+    ManagedRealm realm;
+
+    @InjectSimpleHttp
+    SimpleHttp simpleHttp;
+
+    @InjectOAuthClient
+    OAuthClient  oAuthClient;
+
+    @Test
+    public void testPreflight() throws IOException {
+        try (SimpleHttpResponse response = simpleHttp.doOptions(getUrl()).header("Origin", "https://origin1").asResponse()) {
+            Assertions.assertEquals(200, response.getStatus());
+            Assertions.assertEquals("https://origin1", response.getFirstHeader("Access-Control-Allow-Origin"));
+
+            String sortedAllowMethods = Arrays.stream(response.getFirstHeader("Access-Control-Allow-Methods").split(", ")).sorted().collect(Collectors.joining(", "));
+            Assertions.assertEquals("DELETE, GET, OPTIONS, POST, PUT", sortedAllowMethods);
+
+            String sortedAllowHeaders = Arrays.stream(response.getFirstHeader("Access-Control-Allow-Headers").split(", ")).sorted().collect(Collectors.joining(", "));
+            Assertions.assertEquals("Accept, Access-Control-Request-Headers, Access-Control-Request-Method, Authorization, Content-Type, DPoP, Origin, X-Requested-With", sortedAllowHeaders);
+
+            Assertions.assertEquals("true", response.getFirstHeader("Access-Control-Allow-Credentials"));
+        }
+
+        try (SimpleHttpResponse response = simpleHttp.doOptions(getUrl() + "/someclient").header("Origin", "https://origin1").asResponse()) {
+            Assertions.assertEquals(200, response.getStatus());
+            Assertions.assertEquals("https://origin1", response.getFirstHeader("Access-Control-Allow-Origin"));
+        }
+    }
+
+    @Test
+    public void testCreateClientValidOrigin() throws IOException {
+        createClient("testCreateClientValidOrigin", "https://origin1", true);
+    }
+
+    @Test
+    public void testWithServiceAccount() throws IOException {
+        String realmManagementId = realm.admin().clients().findByClientId("realm-management").get(0).getId();
+        RoleRepresentation createClientRoleRep = realm.admin().clients().get(realmManagementId).roles().get("create-client").toRepresentation();
+        Response response = realm.admin().clients().create(ClientConfigBuilder.create().clientId("testWithServiceAccount").secret("secret").serviceAccountsEnabled(true).webOrigins("https://origin1").build());
+        String clientUuid = CreatedResponseUtil.getCreatedId(response);
+        String serviceAccountUuid = realm.admin().clients().get(clientUuid).getServiceAccountUser().getId();
+        realm.admin().users().get(serviceAccountUuid).roles().clientLevel(realmManagementId).add(List.of(createClientRoleRep));
+
+        String accessToken = oAuthClient.client("testWithServiceAccount", "secret").doClientCredentialsGrantAccessTokenRequest().getAccessToken();
+
+        createClient(accessToken, "testWithServiceAccount1", "https://origin1", true);
+        createClient(accessToken, "testWithServiceAccount2", "https://invalid", false);
+    }
+
+    @Test
+    public void testAnonymous() throws IOException {
+        List<ComponentRepresentation> components = realm.admin().components().query(null, ClientRegistrationPolicy.class.getCanonicalName()).stream().filter(c -> c.getProviderId().equals(RegistrationWebOriginsPolicyFactory.PROVIDER_ID)).toList();
+        for (ComponentRepresentation component : components) {
+            realm.updateComponentWithCleanup(component.getId(), c -> c.getConfig().put(RegistrationWebOriginsPolicyFactory.WEB_ORIGINS, List.of("https://origin3")));
+        }
+
+        components = realm.admin().components().query(null, ClientRegistrationPolicy.class.getCanonicalName()).stream().filter(c -> c.getProviderId().equals(TrustedHostClientRegistrationPolicyFactory.PROVIDER_ID)).toList();
+        for (ComponentRepresentation component : components) {
+            realm.updateComponentWithCleanup(component.getId(), c -> {
+                c.getConfig().put(TrustedHostClientRegistrationPolicyFactory.TRUSTED_HOSTS, List.of("127.0.0.1"));
+            });
+        }
+
+        createClient(null, "testWithClientPolicy1", "https://origin3", true);
+    }
+
+    @Test
+    public void testWithClientPolicy() throws IOException {
+        List<ComponentRepresentation> components = realm.admin().components().query(null, ClientRegistrationPolicy.class.getCanonicalName()).stream().filter(c -> c.getProviderId().equals(RegistrationWebOriginsPolicyFactory.PROVIDER_ID)).toList();
+        for (ComponentRepresentation component : components) {
+            realm.updateComponentWithCleanup(component.getId(), c -> c.getConfig().put(RegistrationWebOriginsPolicyFactory.WEB_ORIGINS, List.of("https://origin3")));
+        }
+
+        OIDCClientRepresentation client = createClient(createInitialAccessToken(), "testWithClientPolicy1", "https://origin3", true);
+        createClient(createInitialAccessToken(), "testWithClientPolicy2", "https://origin4", false);
+
+        client = simpleHttp.doGet(getUrl(client)).auth(client.getRegistrationAccessToken()).header("Origin", "https://origin3").asJson(OIDCClientRepresentation.class);
+
+        Assertions.assertEquals(204, simpleHttp.doDelete(getUrl(client)).auth(client.getRegistrationAccessToken()).header("Origin", "https://origin3").asStatus());
+    }
+
+    @Test
+    public void testCreateClientInValidOrigin() throws IOException {
+        createClient("testCreateClientInValidOrigin", "https://invalid", false);
+    }
+
+    @Test
+    public void testGetClientValidOrigin() throws IOException {
+        OIDCClientRepresentation client = createClient("testGetClientValidOrigin", "https://origin1", true);
+
+        SimpleHttpRequest request = simpleHttp.doGet(getUrl(client)).auth(client.getRegistrationAccessToken()).header("Origin", "https://origin1");
+        try (SimpleHttpResponse response = request.asResponse()) {
+            Assertions.assertEquals(200, response.getStatus());
+        }
+    }
+
+    @Test
+    public void testGetClientInValidOrigin() throws IOException {
+        OIDCClientRepresentation client = createClient("testGetClientInValidOrigin", "https://origin1", true);
+
+        SimpleHttpRequest request = simpleHttp.doGet(getUrl(client)).auth(client.getRegistrationAccessToken()).header("Origin", "https://invalid");
+        try (SimpleHttpResponse response = request.asResponse()) {
+            Assertions.assertEquals(403, response.getStatus());
+        }
+    }
+
+    @Test
+    public void testUpdateClientValidOrigin() throws IOException {
+        OIDCClientRepresentation client = createClient("testUpdateClientValidOrigin", "https://origin1", true);
+        client.setClientName("updated");
+
+        RegistrationAccessToken registrationAccessToken = oAuthClient.parseToken(client.getRegistrationAccessToken(), RegistrationAccessToken.class);
+        Assertions.assertTrue(registrationAccessToken.getAllowedOrigins().contains("https://origin1"));
+
+        SimpleHttpRequest request = simpleHttp.doPut(getUrl(client)).auth(client.getRegistrationAccessToken()).json(client).header("Origin", "https://origin1");
+        try (SimpleHttpResponse response = request.asResponse()) {
+            Assertions.assertEquals(200, response.getStatus());
+        }
+
+        Assertions.assertEquals("updated", realm.admin().clients().findByClientId(client.getClientId()).get(0).getName());
+    }
+
+    @Test
+    public void testUpdateClientInValidOrigin() throws IOException {
+        OIDCClientRepresentation client = createClient("testUpdateClientInValidOrigin", "https://origin1", true);
+        client.setClientName("updated");
+
+        SimpleHttpRequest request = simpleHttp.doPut(getUrl(client)).auth(client.getRegistrationAccessToken()).json(client).header("Origin", "https://invalid");
+        try (SimpleHttpResponse response = request.asResponse()) {
+            Assertions.assertEquals(403, response.getStatus());
+        }
+
+        Assertions.assertNotEquals("updated", realm.admin().clients().findByClientId(client.getClientId()).get(0).getName());
+    }
+
+    private OIDCClientRepresentation createClient(String name, String origin, boolean expectSuccess) throws IOException {
+        return createClient(createInitialAccessToken(), name, origin, expectSuccess);
+    }
+
+    private OIDCClientRepresentation createClient(String token, String name, String origin, boolean expectSuccess) throws IOException {
+        SimpleHttpRequest request = simpleHttp.doPost(getUrl()).json(createClient(name)).header("Origin", origin);
+        if (token != null) {
+            request.auth(token);
+        }
+        OIDCClientRepresentation createdClient;
+        try (SimpleHttpResponse response = request.asResponse()) {
+            if (expectSuccess) {
+                Assertions.assertEquals(201, response.getStatus());
+                Assertions.assertEquals(origin, response.getFirstHeader("Access-Control-Allow-Origin"));
+                createdClient = response.asJson(OIDCClientRepresentation.class);
+            } else {
+                Assertions.assertEquals(403, response.getStatus());
+                Assertions.assertNull(response.getHeader("Access-Control-Allow-Origin"));
+                createdClient = null;
+            }
+        }
+        assertClientExists(expectSuccess, name);
+        return createdClient;
+    }
+
+    private String createInitialAccessToken() {
+        ClientInitialAccessCreatePresentation initialAccessCreatePresentation = new ClientInitialAccessCreatePresentation(0, 10);
+        initialAccessCreatePresentation.setWebOrigins(List.of("https://origin1", "https://origin2"));
+        return realm.admin().clientInitialAccess().create(initialAccessCreatePresentation).getToken();
+    }
+
+    private OIDCClientRepresentation createClient(String name) {
+        OIDCClientRepresentation client = new OIDCClientRepresentation();
+        client.setClientName(name);
+        return client;
+    }
+
+    private String getUrl() {
+        return realm.getBaseUrl() + "/clients-registrations/openid-connect";
+    }
+
+    private String getUrl(OIDCClientRepresentation client) {
+        return getUrl() + "/" + client.getClientId();
+    }
+
+    private void assertClientExists(boolean expected, String clientName) {
+        Optional<ClientRepresentation> clientCreated = realm.admin().clients().findAll().stream().filter(f -> clientName.equals(f.getName())).findFirst();
+        Assertions.assertEquals(expected, clientCreated.isPresent());
+    }
+
+}