RDM 17.2.0 Upgrade Notes

The RDM web application now sends the Keycloak logout request as a POST form instead of a GET redirect.

If a reverse proxy in front of the application, or the application’s own security header configuration, sets a Content-Security-Policy header with a form-action directive, add the Keycloak origin to it. Otherwise, the browser blocks the logout request and users stay logged in.

If your deployment doesn’t add a similar directive, no action is needed.