Repository navigation
Double click on social provider link causes page has expired error #35278
Description
Before reporting an issue
- I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
login/ui
Describe the bug
Double click on social provider link causes page has expired error.
The server throws the following error:
ERROR [org.keycloak.services.resources.IdentityBrokerService] (executor-thread-13) unexpectedErrorHandlingRequestMessage: jakarta.ws.rs.WebApplicationException: HTTP 200 OK
at org.keycloak.services.resources.IdentityBrokerService.parseSessionCode(IdentityBrokerService.java:1161)
at org.keycloak.services.resources.IdentityBrokerService.performLogin(IdentityBrokerService.java:380)
at org.keycloak.services.resources.IdentityBrokerService$quarkusrestinvoker$performLogin_639fa76256feb47da66621dcdd20f8de386404c5.invoke(Unknown Source)
at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:635)
at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2516)
at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2495)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1521)
at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:11)
at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:11)
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
at java.base/java.lang.Thread.run(Thread.java:1583)
Version
main
Regression
- The issue is a regression
Expected behavior
The second click is not possible or is not causing an error
Actual behavior
The second click causes an error
How to Reproduce?
- Add a social provider with some random client ID/secret
- Quickly double click on the social provider link on the login form
- Page has expired error page is shown
Anything else?
No response
Metadata
Metadata
Assignees
Labels
Type
Fields
No fields configured for issues without a type.
Activity
edewit commentedon Dec 2, 2024
why would you double click on links?
added click handler that removes itself on initial click
athenacykes commentedon Dec 2, 2024
Sometimes the network may be slow and user will be stuck at the login screen while waiting for the redirection. If, before the successful redirection, the user becomes impatient and clicked a second time, it will trigger this bug and it will look like it's Keycloak causing a login error.
I am the person who reported this issue via RH support. I discovered this behavior when we got reported that Keycloak is having issue while the actual root cause is that there is some network issue on some of our Android-based devices, causing the devices unable to connect to the Social Provider (timed out) and it appears as the device still staying at the login screen after the first click / touch. After the user clicks / touches a second time, it shows "Page has expired" and the redirection attempt is also cancelled.
Also we were observing logs like this since RH-SSO 7.4 and we opened RH case tickets before and have no luck finding the true root cause. It seems that the double click is the real root cause behind this kind of error logs.
Ah, and I think that the clicking and touching on a mobile device are different events - we may need to treat them both.
Edit: Also --- may I know the reason behind why the second click becomes "Page has expired"? Is this by design of how authentication flow works?
33 remaining items
Disable social links after being clicked (#39031)
Disable social links after being clicked (keycloak#39031)
Disable social links after being clicked (#39031)
Disable social links after being clicked (keycloak#39031)
Disable social links after being clicked (#39031)