Keycloak state param in redirect URL on Login

See original GitHub issue

I am having SSO implementation using keaycloak in an angular app and it is working fine, But on login into the application it redirects to the app URL with having state param in URL as below.

I am using angular-oauth2-oidc v10.0.3

Is there any way or config for removing the state param from URL.

AuthConfig:

export var authConfig: AuthConfig = {
  issuer: 'https://keycloak.poc.com/auth/realms/local',
  redirectUri: 'http://localhost:4200/',
  responseType: 'code',
  requireHttps: false,
  showDebugInformation: true,
  disableAtHashCheck: false
};

Issue Analytics

State:
Created 2 years ago
Comments:7

Top GitHub Comments

2reactions

eskindergcommented, May 30, 2022

I don’t know why this got closed but i am having the same problem of having the state in the URL after login. The hard part is, if you refresh the page in your first login attempt, keycloak will give you an error because of the long URL.

1reaction

kmohit520commented, May 7, 2021

Thanks for quick response. Checked the flow using those breakpoints and it is going inside below codeblock of tryLoginCodeFlow

if (!options.preventClearHashAfterLogin) {
            const href = location.href
                .replace(/[&\?]code=[^&\$]*/, '')
                .replace(/[&\?]scope=[^&\$]*/, '')
                .replace(/[&\?]state=[^&\$]*/, '')
                .replace(/[&\?]session_state=[^&\$]*/, '');
            history.replaceState(null, window.name, href);
        }

and clearing the params.

What I wanted to know is, if it is possible to never have that ?state param at anytime in URL. Both current and desired flow mentioned below:

Current Flow: