Repository navigation
Should OAuth consent themes expose the validated redirect URI? #53792
lilianmisser-dg
started this conversation in
Ideas
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
I’m exploring how to make Keycloak’s OAuth consent page clearer about where an authorization response will be sent.
The MCP authorization security considerations say authorization servers MUST clearly display the redirect URI hostname during authorization, and SHOULD warn when a redirect URI is localhost-only.
Today, a Keycloak consent theme does not appear to have access to the active, validated redirect URI. The URI may be present in the
client_dataquery parameter, but I’m unsure whether that value is bound to the URI validated for the current authentication session. Reading it directly from the request could risk displaying a value that does not match the session.Would it make sense for Keycloak to expose the validated redirect URI—or at least its hostname—to OAuth consent templates? Themes could then show users the callback host and optionally warn about localhost callbacks without relying on an unverified query parameter.
Linked Issue: #53743
All reactions