window.config = {
  // default: '/'
  routerBasename: '/',
  // default: ''
  relativeWebWorkerScriptsPath: '',
  servers: {
    dicomWeb: [
      {
        name: 'Orthanc',
        wadoUriRoot: 'http://127.0.0.1/pacs/wado',
        qidoRoot: 'http://127.0.0.1/pacs/dicom-web',
        wadoRoot: 'http://127.0.0.1/pacs/dicom-web',
        qidoSupportsIncludeField: false,
        imageRendering: 'wadors',
        thumbnailRendering: 'wadors',
        // REQUIRED TAG:
        // https://github.com/OHIF/ohif-core/blob/59e1e04b92be24aee5d4402445cb3dcedb746995/src/studies/retrieveStudyMetadata.js#L54
        requestOptions: {
          //   auth: 'orthanc:orthanc', // undefined to use JWT + Bearer auth
          requestFromBrowser: true,
          //   logRequests: true,
          //   logResponses: false,
          //   logTiming: true,
        },
      },
    ],
  },
  oidc: [
    {
      // ~ REQUIRED
      // Authorization Server URL
      authority: 'http://127.0.0.1/auth/realms/master',
      client_id: 'ohif-viewer',
      redirect_uri: '/callback', // `OHIFStandaloneViewer.js`
      response_type: 'id_token',
      scope: 'openid', // email profile openid
      // ~ OPTIONAL
      post_logout_redirect_uri: '/logout-redirect.html',
    },
  ],
}

@@ -594,16 +594,122 @@
 .js#L54%0A
+        // TODO: Remove tag after https://github.com/OHIF/ohif-core/pull/19 is merged and we bump version%0A
         
@@ -1153,16 +1153,32 @@
 t_uri: '
+http://127.0.0.1
 /callbac
@@ -1210,16 +1210,151 @@
 wer.js%60%0A
+      // %22Authorization Code Flow%22%0A      // Resource: https://medium.com/@darutk/diagrams-of-all-the-openid-connect-flows-6968e3990660%0A
       re
@@ -1371,16 +1371,12 @@
 e: '
-id_token
+code
 ',%0A 

Use a more secure flow, and be more explicit with redirects for security's sake