Repository navigation
How to break infinite redirect loop on Keycloak Authorization Code Flow error (before token exchange)? #39846
Unanswered
carlosrodovalho
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hi all,
I'm using Keycloak with the Authorization Code Flow in my PHP application. The flow works like this:
User authenticates on Keycloak.
Keycloak redirects to my app with only the code parameter.
My app exchanges the code for tokens (access_token, id_token, etc.) using the Keycloak token endpoint.
The problem:
If an error occurs after I get the tokens, I can use id_token_hint to log the user out of Keycloak and redirect them to the login page, which works fine.
But if an error occurs during the code exchange (i.e., after receiving the code but before getting any tokens), I don't have the id_token, so I can't log the user out of Keycloak. If I simply redirect the user back to the Keycloak login page, Keycloak detects the active session and immediately redirects back to my app with a new code, causing an infinite redirect loop.
Question:
What is the proper way to handle errors that happen after receiving the authorization code, but before obtaining the tokens, so I can break this loop and allow the user to try authenticating again?
Any best practices or recommended approaches for this scenario?
All reactions