Issues

`check-sso` waits for the login-status iframe before silent SSO, which always runs for logged-in users

keycloak/keycloak-js#375 · opened

on Nov 7, 2026

Third-party cookie check runs even when its result cannot change behavior

keycloak/keycloak-js#374 · opened

on Nov 7, 2026

Enrich release notes for keycloak-js 26.2.5

keycloak/keycloak-js#371 · opened

on Oct 29, 2026

`updateToken()` calls `clearToken()` — and so `onAuthLogout` — on any token-endpoint HTTP 400, although `onAuthLogout` is documented to fire only from the session-status iframe or in Cordova mode

keycloak/keycloak-js#367 · opened

on Oct 18, 2026

sandbox="allow-scripts allow-same-origin" on the silent check-sso iframe triggers a browser warning and adds no isolation

keycloak/keycloak-js#353 · opened

on Oct 5, 2026

Error message 'invalid redirect url' when logging out with keycloak 26.7.3

keycloak/keycloak-js#349 · opened

on Sep 23, 2026

`#checkSsoSilently` skips the `oauth.valid` guard — a missing `kc-callback-*` entry becomes a token exchange with `redirect_uri=undefined` (server `invalid_redirect_uri`) instead of "not authenticated"

keycloak/keycloak-js#339 · opened

on Sep 1, 2026

DoS via unvalidated loop iteration in parseCallbackParams()

weakness

keycloak/keycloak-js#334 · opened

on Aug 18, 2026

1

v27 release prep

task

keycloak/keycloak-js#329 · opened

on Jul 27, 2026

1

Unhandled TypeError: "[object Object]" cannot be parsed as a URL in #checkSsoSilently messageCallback when a non-string postMessage arrives

keycloak/keycloak-js#326 · opened

on Jul 22, 2026

1

Expose Account Management REST APIs in `keycloak-js`

keycloak/keycloak-js#323 · opened

on Jul 2, 2026

Allow throwing errors on deprecation warnings

keycloak/keycloak-js#301 · opened

on Apr 22, 2026

· 26.3.0

Support a custom resolveRealmAccess function for light token compatibility

keycloak/keycloak-js#288 · opened

on Mar 26, 2026

POST logout() gets error 'invalid parameter id_token_hint' from server, when the user already has been unauthenticated

keycloak/keycloak-js#287 · opened

on Mar 26, 2026

1

Remove `keycloak-js/authz`

eol

keycloak/keycloak-js#277 · opened

on Feb 26, 2026

Deprecate `keycloak-js/authz`

eol

keycloak/keycloak-js#276 · opened

on Feb 26, 2026

Remove Cordova support

eol

keycloak/keycloak-js#272 · opened

on Feb 18, 2026

· 27.0.0

Keyclock init sometimes does not resolve promise

bug

keycloak/keycloak-js#262 · opened

on Feb 6, 2026

3

Wrong type definition for `amr` claim in parsed token

bug

keycloak/keycloak-js#254 · opened

on Jan 30, 2026

Enforce that redirect URL should be on the same origin as the app

task

keycloak/keycloak-js#235 · opened

on Dec 9, 2025

· 27.0.0

2

Remove re-binding of public methods

eol

keycloak/keycloak-js#234 · opened

on Dec 9, 2025

· 27.0.0

Validate redirection endpoint URLs

bug

keycloak/keycloak-js#220 · opened

on Nov 19, 2025

· 27.0.0

1

Updating from 26.2.0 to 26.2.1 breaks ts based apps because of the change to `KeycloakConfig`

bug

keycloak/keycloak-js#186 · opened

on Oct 9, 2025

Silent Check SSO causes the React application to not render

bug

keycloak/keycloak-js#160 · opened

on Aug 10, 2025

1

support url param forwarding

feature

keycloak/keycloak-js#150 · opened

on Aug 1, 2025

Navigation Menu

Repository navigation

Issues

`check-sso` waits for the login-status iframe before silent SSO, which always runs for logged-in users

Third-party cookie check runs even when its result cannot change behavior

Enrich release notes for keycloak-js 26.2.5

`updateToken()` calls `clearToken()` — and so `onAuthLogout` — on any token-endpoint HTTP 400, although `onAuthLogout` is documented to fire only from the session-status iframe or in Cordova mode

sandbox="allow-scripts allow-same-origin" on the silent check-sso iframe triggers a browser warning and adds no isolation

Error message 'invalid redirect url' when logging out with keycloak 26.7.3

`#checkSsoSilently` skips the `oauth.valid` guard — a missing `kc-callback-*` entry becomes a token exchange with `redirect_uri=undefined` (server `invalid_redirect_uri`) instead of "not authenticated"

DoS via unvalidated loop iteration in parseCallbackParams()

v27 release prep

Unhandled TypeError: "[object Object]" cannot be parsed as a URL in #checkSsoSilently messageCallback when a non-string postMessage arrives

Expose Account Management REST APIs in `keycloak-js`

Allow throwing errors on deprecation warnings

Support a custom resolveRealmAccess function for light token compatibility

POST logout() gets error 'invalid parameter id_token_hint' from server, when the user already has been unauthenticated

Remove `keycloak-js/authz`

Deprecate `keycloak-js/authz`

Remove Cordova support

Keyclock init sometimes does not resolve promise

Wrong type definition for `amr` claim in parsed token

Enforce that redirect URL should be on the same origin as the app

Remove re-binding of public methods

Validate redirection endpoint URLs

Updating from 26.2.0 to 26.2.1 breaks ts based apps because of the change to `KeycloakConfig`

Silent Check SSO causes the React application to not render

support url param forwarding