Repository navigation
Conversation
Signed-off-by: t-tani <31282248+t-tani@users.noreply.github.com>
There was a problem hiding this comment.
Thanks @t-tani for the PR! As you mentioned, this solution mitigates the issue but doesn’t completely resolve it. Unfortunately, I can’t replicate the issue on an iOS device right now and test the absence of the KC_RESTART cookie. Based on the comments, it seems that the browser is being redirected to the restart URL by authChecker.js and the KC_RESTART cookie is missing. However, it doesn’t make sense to me that the browser should be redirected to the restart URL after login on the same page there could be some kind of block on iOS causing these side effects. So, before moving forward with this solution, it would be better to understand what might be causing the root issue.
|
@graziang Root Cause: Current Implementation:
Problem:
Testing: test site: https://t-tani.github.io/test-beforeunload-event/ result1: behavior of beforeunload event on PC browser (chrome on ubuntu 22.04) result2: behavior of beforeunload event on iOS browser (safari on on iOS 18.01) Potential Solution: Next Steps: |
|
To be honest, I believe the essential problem lies not in Keycloak's implementation, but in how WebKit handles the beforeunload event. However, in the Keycloak instance I manage, we receive a large number of authentication requests from iOS browsers, and this issue is affecting the user experience. Therefore, I'm hoping we can implement some kind of workaround on the Keycloak side to address this problem. |
|
One question @t-tani, reading some info about this it seems thatthe problem is that iOS does not manage the event diff --git a/themes/src/main/resources/theme/base/login/resources/js/authChecker.js b/themes/src/main/resources/theme/base/login/resources/js/authChecker.js
index 8507e71663..e5fdcb58a8 100644
--- a/themes/src/main/resources/theme/base/login/resources/js/authChecker.js
+++ b/themes/src/main/resources/theme/base/login/resources/js/authChecker.js
@@ -6,12 +6,8 @@ let timeout;
// Remove the timeout when unloading to avoid execution of the
// checkCookiesAndSetTimer when the page is already submitted
-addEventListener("beforeunload", () => {
- if (timeout) {
- clearTimeout(timeout);
- timeout = undefined;
- }
-});
+addEventListener("beforeunload", clearTimeoutOnEvent);
+addEventListener("pagehide", clearTimeoutOnEvent);
export function checkCookiesAndSetTimer(loginRestartUrl) {
if (initialSession) {
@@ -42,6 +38,13 @@ export function checkAuthSession(pageAuthSessionHash) {
}, AUTH_SESSION_TIMEOUT_MILLISECS);
}
+function clearTimeoutOnEvent(event) {
+ if (timeout) {
+ clearTimeout(timeout);
+ timeout = undefined;
+ }
+}
+
function getKcAuthSessionHash() {
return getCookieByName("KC_AUTH_SESSION_HASH");
}Does this change work for you in iOS? |
|
@rmartinc Thank you for the suggestion. I have tested the scenario setting both Here I set both events in the authChecker.js and tested with Safari browser (iOS 18.0.1) but unexpected restart request was called. I have not debugged the |
|
And using --- a/themes/src/main/resources/theme/base/login/resources/js/authChecker.js
+++ b/themes/src/main/resources/theme/base/login/resources/js/authChecker.js
@@ -6,10 +6,10 @@ let timeout;
// Remove the timeout when unloading to avoid execution of the
// checkCookiesAndSetTimer when the page is already submitted
-addEventListener("beforeunload", () => {
- if (timeout) {
- clearTimeout(timeout);
- timeout = undefined;
+addEventListener("beforeunload", clearTimeoutOnEvent);
+addEventListener("visibilitychange", (event) => {
+ if (document.visibilityState == 'hidden') {
+ clearTimeoutOnEvent(event)
}
});
@@ -42,6 +42,13 @@ export function checkAuthSession(pageAuthSessionHash) {
}, AUTH_SESSION_TIMEOUT_MILLISECS);
}
+function clearTimeoutOnEvent(event) {
+ if (timeout) {
+ clearTimeout(timeout);
+ timeout = undefined;
+ }
+}
+
function getKcAuthSessionHash() {
return getCookieByName("KC_AUTH_SESSION_HASH");
}Sorry, but I cannot test iOS. 😄 |
|
Unfortunately, |
|
@jonkoops |
|
The root cause has been addressed in PR #35143 which provides a comprehensive fix for this issue. Therefore, I will proceed to close this PR. Thank you for the feedback and support during the investigation. |
@jonkoops
I have found another approach to mitigate the RESTART_AUTHENTICATION_ERROR in iOS browsers, so I opened this PR.
Issue
Closes #33071
Summary of Changes
This PR introduces a 2000ms delay in the checkCookieAndSetTimer function to address authentication errors on iOS browsers. This fix make amends for the unreliable beforeunload event in iOS browsers, which can cause RESTART_AUTHENTICATION_ERROR.
Key points
checkCookieAndSetTimerI have confirmed that on my iPhone and iPad using Safari/Chrome with Keycloak 26.0.5, errors do not occur unless there are significant network speed issues or loading delays. However, it's important to note that this is only a mitigation for the unreliable beforeunload event, so it cannot completely eliminate the issue.
Related PR
PR #34709