8000 Throw exception and rollback when token verification fails in reset credentials (26.7) by rmartinc · Pull Request #50930 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Throw exception and rollback when token verification fails in reset credentials (26.7) #50930

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ahus1 merged 1 commit into from
Jul 16, 2026
Merged

Throw exception and rollback when token verification fails in reset credentials (26.7) #50930

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions services/src/main/java/org/keycloak/services/ErrorPageException.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@

import org.keycloak.models.KeycloakSession;
import org.keycloak.sessions.AuthenticationSessionModel;
import org.keycloak.utils.KeycloakSessionUtil;

/**
* @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
Expand All @@ -39,4 +40,14 @@ public ErrorPageException(KeycloakSession session, AuthenticationSessionModel au
public ErrorPageException(Response response) {
super((Throwable) null, response);
}

@Override
public Response getResponse() {
KeycloakSession session = KeycloakSessionUtil.getKeycloakSession();
if (session != null) {
// set rollback if exception is thrown to not commit changes into database
session.getTransactionManager().setRollbackOnly();
}
return super.getResponse();
}
}
9 changes: 5 additions & 4 deletions services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,7 @@
import org.keycloak.representations.AccessToken;
import org.keycloak.representations.AuthorizationDetailsJSONRepresentation;
import org.keycloak.services.ErrorPage;
import org.keycloak.services.ErrorPageException;
import org.keycloak.services.ErrorResponseException;
import org.keycloak.services.ServicesLogger;
import org.keycloak.services.Urls;
Expand Down Expand Up @@ -1070,9 +1071,9 @@ public static Response redirectToRequiredActions(KeycloakSession session, RealmM

}

private static Response handleActionTokenVerificationException(KeycloakSession session, EventBuilder event, String eventError, String errorMessage) {
private static void handleActionTokenVerificationException(KeycloakSession session, EventBuilder event, String eventError, String errorMessage) {
event.error(eventError);
return ErrorPage.error(session, null, Response.Status.BAD_REQUEST, errorMessage == null ? Messages.INVALID_CODE : errorMessage);
throw new ErrorPageException(session, null, Response.Status.BAD_REQUEST, errorMessage == null ? Messages.INVALID_CODE : errorMessage);
}


Expand All @@ -1084,12 +1085,12 @@ public static Response finishedRequiredActions(KeycloakSession session, Authenti
if (actionTokenKey != null) {
// Token has expired. We must not accept it, as it will have been removed from the single use provider already
if (Time.currentTime() > actionTokenKey.getExp()) {
return handleActionTokenVerificationException(session, event, Errors.EXPIRED_CODE, Messages.EXPIRED_ACTION);
handleActionTokenVerificationException(session, event, Errors.EXPIRED_CODE, Messages.EXPIRED_ACTION);
}

var revokedTokens = session.revokedTokens();
if (!revokedTokens.put(actionTokenKeyToInvalidate, actionTokenKey.getExp() - Time.currentTime() + CLOCK_SKEW_SECONDS)) {
return handleActionTokenVerificationException(session, event, Errors.EXPIRED_CODE, Messages.EXPIRED_ACTION);
handleActionTokenVerificationException(session, event, Errors.EXPIRED_CODE, Messages.EXPIRED_ACTION);
}
}
}
Expand Down
7 changes: 6 additions & 1 deletion ...n-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/ResetPasswordTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -459,9 +459,14 @@ public void resetPasswordTwiceInSecondBrowser() throws IOException {
assertThat(driver2.getPageSource(), Matchers.containsString("Back to Application"));

// Updating the password in the first browser should now fail.
updatePasswordPage.changePassword(password, password);
updatePasswordPage.changePassword("invalid-new-password", "invalid-new-password");
errorPage.assertCurrent();
assertEquals("Action expired. Please continue with login now.", errorPage.getError());

// check the password works
oauth.openLoginForm();
loginPage.login(username, "resetPassword");
assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
}

public void assertSecondPasswordResetFails(String changePasswordUrl, String clientId) {
Expand Down
Loading
0