Repository navigation
JavaScript Injection in frontchannel-logout.ftl via frontchannel-logout.title #48241
Description
Before reporting an issue
- I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
authentication
Describe the bug
The file frontchannel-logout.ftl uses a properties directly in javascript. Messages are controlled by realm administrators, so low risk, but better if we improve this.
We can use a javascript output <#outputformat "JavaScript"> and use "${msg("frontchannel-logout.title")?c} to properly escape the message or add a title parameter to the templates and add it normally in the HTML part.
Version
26.6.1
Regression
- The issue is a regression
Expected behavior
The message should be escaped or added not in JS.
Actual behavior
The msg is added using JS and not properly escaped in the ftl file.
How to Reproduce?
N/A
Anything else?
No response
Metadata
Metadata
Assignees
Labels
Type
Fields
No fields configured for bug.
Activity
ahus1 commentedon Apr 20, 2026
@rmartinc - I would prefer the setup as it would allow a version without JavaScript handling this. I'd be happy to provide pointers.
Add a title atttribute for the freemarker templates
Add a title atttribute for the freemarker templates (#48276)
7 remaining items
dominiktopp commentedon Jun 23, 2026
Hi @rmartinc,
unfortunately your fix is introducing an new bug one or is a breaking change:
When realm display name is a placeholder, e.g.
${myRealmDisplayNameKey}and a localization (either in realm overrides or in theme) for this keyMy browser tab title for myRealm:My browser tab title for myRealm.${myRealmDisplayNameKey}The old Keycloak version used
<title>${msg("loginTitle",(realm.displayName!''))}</title>andmsg(MessageFormatterMethod.java) also resolves placeholders in the params.The new Keycloak version uses
getMessage("loginTitle", realmBean.getDisplayName())butFreeMarkerLoginFormsProvider#getMessagedoes NOT resolve placeholders in the params array.Our workaround is to reset the
titleattribute in template.ftl to usingmsg.Should we reopen this issue or create a new one?
Add a title atttribute for the freemarker templates (keycloak#48276)