[keycloak-dev] JavaScript adapter & caching of session status iframe

Hi all, We have found an issue when using the JavaScript Adapter [1] and upgrading from Keycloak 2.5.1 Final to 3.1.0.Final [2] Using default settings, Keycloak will send a cache-control header to the browser and will cache the iframe status page for 30 days. [3] If you happen to upgrade Keycloak within those 30 days, there is a out-of-sync interaction between the adapter and Keycloak. The browser won't even make the HTTP request before those 30 days, and the upgraded adapter code will attempt to use code from a page that is oudated. A potential solution is that we use the Keycloak version as cache busting via query parameters [4], e.g. when injecting the iframe it will append the Keycloak version: https://kc-host/realms/realm/protocol/openid-connect/login-status-iframe.... Another 'easier' solution is to not cache the status iframe at all. This is easier because the JS Adapter is *not* version aware. To include the version as cache busting, we'll need to include it as part of the Keycloak object, that means touching this file on every release, even if the code itself has not changed. Do you consider this a bug? Should i log it in JIRA? We're happy to contribute the change. [1] http://www.keycloak.org/docs/3.1/securing_apps/topics/oidc/javascript-ada... [2] https://github.com/akvo/akvo-lumen/issues/801 [3] https://github.com/keycloak/keycloak/blob/3.1.0.Final/services/src/main/j... [4] https://stackoverflow.com/questions/9692665/cache-busting-via-params -- Iván