Repository navigation
OAuth2.1 authorization flow with an SPA #14429
carloterzo
started this conversation in
Feedback
Replies: 2 comments 1 reply
|
With the current storage, Keycloak stores session in memory so there are no database writes. It does write an event to the EVENT_ENTITY table if you activated writing audit events though. |
0 replies
|
@sschu so when after the first time a session is created and an access token is released what happened if an SPA client recall the two endpoint (/authorize, /token) for a new (useless) token ? |
1 reply
|
It doesn't write a row because sessions are not stored in the database. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hi guys,
can I ask you how Keycloak works when an user from an SPA is successfully authenticated on server (with username/password login) an access token is been released to him, a session for that user exists on server and I suppose at least 1 row is written on db.
If the SPA redo multiple times the flow /authenticate and /token what is the behaviour of Keycloak ? I mean, it writes multiple rows on db releasing different code/token even if it's the same session from the same client/user or it has some strategies to identify him avoiding db overload ?
I'm using another implementation of OAuth2.1 server that doesn't identify the same session overloading db.
Thanks in advance
All reactions