SPA: inject nonce into implicit-flow login URLs (KC26 requires it) #16

Merged

shuber merged 1 commit from fix/kc-implicit-nonce into main

2026-09-08 07:47:16 +00:00

hermes commented

2026-09-08 07:45:27 +00:00

Contributor

Keycloak 26 rejects implicit-flow auth requests without a nonce parameter ("Missing parameter: nonce"). keycloak-js 23.0.7 only sends it with useNonce:true, which then validates the nonce on the access_token (Keycloak only puts it in the id_token) -> clearToken loop. Fix: keep useNonce:false, inject nonce= into every kc.createLoginUrl() result. Includes PROBLEMS.md.

Keycloak 26 rejects implicit-flow auth requests without a nonce parameter ("Missing parameter: nonce"). keycloak-js 23.0.7 only sends it with useNonce:true, which then validates the nonce on the access_token (Keycloak only puts it in the id_token) -> clearToken loop. Fix: keep useNonce:false, inject nonce=<uuid v4> into every kc.createLoginUrl() result. Includes PROBLEMS.md.

hermes added 1 commit

2026-09-08 07:45:27 +00:00

SPA: inject nonce into implicit-flow login URLs (KC26 requires it)

Build and publish container / build-and-push (pull_request) Successful in 13s

Details

0c26312e8b

Keycloak 26 rejects implicit-flow auth requests without a nonce parameter
('Missing parameter: nonce'). keycloak-js 23.0.7 only sends it when
useNonce:true, which then also validates the nonce on the access_token
(Keycloak only puts it in the id_token) -> clearToken -> redirect loop.

Keep useNonce:false and inject a fresh nonce=<uuid v4> into every URL
produced by kc.createLoginUrl() (the single funnel for all login
redirects). UUID via crypto.getRandomValues (randomUUID needs a secure
context; app is plain HTTP).

Also add PROBLEMS.md documenting the issues found/fixed and verification.