[keycloak-dev] advice on back button

[Bill Burke]

The current thinking for browser back button is to set:

Cache-Control: no-store, must-revalidate, max-age=0

There are possible security issues with this that I don't know if we 
should do this or not.  Don't know if you remember how ClientSessionCode 
works, it uses a hash of the client session id and the action key 
currently stored in the.  When you switch from authentication to 
required actions, the action key changes.  Now, if you hit the back 
button on a required action page, it would take you back to an 
authentication screen.  The code check would fail because the action 
keys don't match.

Do we actually need this action key stuff?  Can we just let the flow 
manager put the browser in the correct state?  So if an "authenticate" 
url is hit and the flow is on required actions, just redirect to the 
required actions URL.   I just worry that this is some sort of security 
hole somehow.  Maybe we're better off just reseting and restarting the 
flow entirely.

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com