ssilvert · May 5, 2026 · Apr 20, 2026 · May 1, 2026 · May 4, 2026 · May 4, 2026
@@ -0,0 +1,31 @@
+/*
+ * Copyright 2026 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.quarkus.deployment;
+
+import java.util.function.BooleanSupplier;
+
+import org.keycloak.quarkus.runtime.Environment;
+
+public class IsKeycloakDevMode implements BooleanSupplier {
+
+    @Override
+    public boolean getAsBoolean() {
+        return Environment.isDevMode();
+    }
+
+}
@@ -98,6 +98,7 @@
 import org.keycloak.quarkus.runtime.integration.resteasy.KeycloakHandlerChainCustomizer;
 import org.keycloak.quarkus.runtime.integration.resteasy.KeycloakTracingCustomizer;
 import org.keycloak.quarkus.runtime.logging.ClearMappedDiagnosticContextFilter;
+import org.keycloak.quarkus.runtime.services.RejectSourceMapFilter;
 import org.keycloak.quarkus.runtime.services.health.BootstrapReadyHealthCheck;
 import org.keycloak.quarkus.runtime.services.health.KeycloakClusterReadyHealthCheck;
 import org.keycloak.quarkus.runtime.services.health.KeycloakReadyHealthCheck;
@@ -310,6 +311,11 @@ void filterAllManagementRequests(BuildProducer<ManagementInterfaceFilterBuildIte
         }
     }
 
+    @BuildStep(>
+    void filterSourceMapRequests(BuildProducer<FilterBuildItem> filters) {
+        filters.produce(new FilterBuildItem(new RejectSourceMapFilter(), SecurityHandlerPriorities.CORS + 1));
+    }
+
     @Record(ExecutionTime.STATIC_INIT)
     @BuildStep(>
     @Consume(ConfigBuildItem.class)

@@ -0,0 +1,48 @@
+/*
+ * Copyright 2026 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.quarkus.runtime.services;
+
+import io.vertx.core.Handler;
+import io.vertx.ext.web.RoutingContext;
+import org.jboss.logging.Logger;
+
+/**
+ * Blocks HTTP requests for JavaScript source map files (.js.map) when not running in dev mode.
+ * Source maps are retained on disk for support diagnostics but must not be served
+ * to clients in production, as they can expose internal implementation details of
+ * customized themes.
+ *
+ * @see <a href="https://github.com/keycloak/keycloak/issues/47545">GitHub #47545</a>
+ */
+public class RejectSourceMapFilter implements Handler<RoutingContext> {
+
+    private static final Logger LOGGER = Logger.getLogger(RejectSourceMapFilter.class);
+
+    @Override
+    public void handle(RoutingContext routingContext) {
+        String path = routingContext.normalizedPath();
+
+        if (path.endsWith(".js.map")) {
+            LOGGER.debugf("Blocked source map request: %s", path);
+            routingContext.fail(404);
+            return;
+        }
+
+        routingContext.next();
+    }
+}