8000 Client session note removals are not persisted with persistent user sessions · Issue #52038 · keycloak/keycloak · GitHub
[go: up one dir, main page]

Skip to content

Client session note removals are not persisted with persistent user sessions #52038

Closed

Description

@thomasdarimont

Before reporting an issue

  • I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

core

Describe the bug

With persistent user sessions (default since 25.0.0), writing an authenticated client session note is persisted, but removing
one is silently dropped. AuthenticatedClientSessionModel#removeNote and restartClientSession() (which clears all notes)
only update the cached entity; the database keeps the note for the lifetime of the session, and it resurfaces whenever the
session is re-read from the database (restart, failover, cache eviction).

Root cause: JpaChangesPerformer#mergeClientSession replays the recorded update tasks against a synthetic AuthenticatedClientSessionEntity whose getNotes() returns a fresh anonymous HashMap that only overrides get and put.
remove, clear, containsKey, iteration etc. run against that throwaway map, so removeNote -> entity.getNotes().remove(name)
and restartClientSession() -> entity.getNotes().clear() never reach the persisted model.
The user session counterpart in mergeUserSession does override remove/clear, so this looks like an oversight rather than intended.

Version

26.7.2

Regression

  • The issue is a regression

Expected behavior

Removed and cleared client session notes are absent from the persisted client session after the transaction commits.

Actual behavior

Every note ever written stays in the persisted row; only overwrites (put) are persisted.

How to Reproduce?

  1. Create a user session and a client session, set a note on the client session.
  2. In a new transaction, call clientSession.removeNote(name) (or restartClientSession()).
  3. Read the client session back via UserSessionPersisterProvider#loadClientSession (or SELECT data FROM offline_client_session): the note is still there.

Anything else?

Observed with 26.7.2 but seems to be like this since 25.0.0.

Activity

  1. 3 remaining items

  2. added a commit that references this issue on Aug 26, 2026
    3add94b
  3. added a commit that references this issue on Aug 26, 2026
    60cb15e
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Type

Fields

No fields configured for bug.

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    0