Question: I find the method `public ValueStateDescriptor(String name,TypeInformation<T> typeInfo,T defaultValue)`is now deprecated and the documentation says to manage the default value by checking whether the contents of the state is null.
I wonder what does this suggestion for?

Answer: 
We have discovered that our own proxy were writing Access-Control-Allow-Origin header as well. That's why together with keycloak we got it twice.

Our devops team has fixed the code of our proxy and it works now.
`*` is not valid value for `Access-Control-Allow-Origin` for sites running on https. 

Remove `*` from web origins client configuration in the Keycloak and configure all used web origin explicitly (no wildchars).