Refresh Token Returns Previous User's Data After Logging Out #38741

parhamDm · 2025-04-08T10:39:06Z

parhamDm
Apr 8, 2025

We encountered an issue in Keycloak version 25.0.4 where, in certain circumstances, the refresh token returns data of the previously logged-in user rather than the current user.

Scenario:

User A logs in to Client A.
User A signs out from Client A and is returned to the Keycloak login screen.
User A opens a new tab in the same browser and navigates to Client A.
User A logs in with the credentials of User B in the new tab.
User B is correctly recognized as logged in on Client A.
However, when attempting to obtain the refresh token for User B, Keycloak returns the data for User A instead.

Expected Behavior:

The refresh token should return data corresponding to User B, not User A.

Actual Behavior:

The refresh token for User B returns data of User A.

Additional Information:

I have verified this behavior using Postman. When requesting the refresh token for User B, the response includes an access token for User A.
I have checked client configurations and found no issues.
The issue occurs only when two tabs are open in the same browser, with one logged in as User A and the other as User B.
The problem persists across multiple clients.

I am unsure why Keycloak returns User A's token when requesting the refresh token for User B. Could this be due to a misconfiguration?

parazit-IRAN · 2025-04-08T10:52:47Z

parazit-IRAN
Apr 8, 2025

I have the same issue with version 25.0.4

0 replies

Navigation Menu

Repository navigation

Refresh Token Returns Previous User's Data After Logging Out #38741

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Refresh Token Returns Previous User's Data After Logging Out #38741

Uh oh!

parhamDm Apr 8, 2025

Scenario:

Expected Behavior:

Actual Behavior:

Additional Information:

Replies: 1 comment

Uh oh!

parazit-IRAN Apr 8, 2025

parhamDm
Apr 8, 2025

parazit-IRAN
Apr 8, 2025