PR is building...
Browser back button will now either restart the flow (and create a new
client session) or not allow you off your current page depending on the
protocol and where you are in the flow.
* If your protocol is initiated by a GET request and the back button
brings you to the 1st rendered page (username/password) this starts a
new flow
* If your protocol is initiated by a POST request (SAML Post binding)
things work a bit differently. This initial post request will redirect
you to the "authenticate" URL. Then if your back button brings you to
the username/password page, you will not see it and just stay on your
current page.
* If your back button click brings you to the 2nd page in the flow, you
will just be stuck on your current page.
Try it out. Hopefully all these refresh and back button issues are done
now.
Some changes to make this happen:
* The "code" in the URL o the flow used to be generated by hashing the
current action key, the current action (AUTHENTICATE, REQUIRE_ACTION),
and the realm secret key. The action key changed whenever you changed
the current action...NOW the action key does NOT change for the whole
flow. The action key is automatically generated once when you create
the ClientSession and never changed again.
* Consent page no longer changes the current action to OAUTH_GRANT.
Consent page is now considered a REQUIRED_ACTION action and treated as
such. This was to support back button here too.
* Cache-Control: no-store, must-revalidate, max-age=0 is now set in the
response for every endpoint on LoginActionsService and any protocol
entry point.
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-dev mailing list
keycloak-dev@lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev