8000 Ignore non-string messages in silent SSO iframe listener by SAY-5 · Pull Request #327 · keycloak/keycloak-js · GitHub
[go: up one dir, main page]
Skip to content

Ignore non-string messages in silent SSO iframe listener - #327

Open
SAY-5 wants to merge 1 commit into
keycloak:mainfrom
SAY-5:silent-sso-nonstring-message
Open

Ignore non-string messages in silent SSO iframe listener#327
SAY-5 wants to merge 1 commit into
keycloak:mainfrom
SAY-5:silent-sso-nonstring-message

Conversation

@SAY-5
@SAY-5 SAY-5 commented Jul 22, 2026
Copy link
Copy Markdown

The message listener in #checkSsoSilently only guards on event.origin and event.source, so a non-string message posted from inside the silent-check-sso iframe (password manager or autofill scripts, for example) reaches #parseCallback and new URL(event.data) throws. Since the callback is async and the parse happens before the try/catch, this surfaces as an unhandled rejection and the listener and iframe are never cleaned up, so every further injected message throws again. Ignore messages whose data is not a string, in line with the other message listeners that only accept known string values.

Closes #326

@SAY-5
Ignore non-string messages in silent SSO iframe listener
789f260 
Signed-off-by: Sai Asish Y <say.apm35@gmail.com>
@SAY-5
SAY-5 requested a review from jonkoops as a code owner July 22, 2026 19:19
@ylligashi
ylligashi commented Oct 15, 2026
Copy link
Copy Markdown

We're seeing this in production too (keycloak-js 26.2.4, onLoad: 'check-sso' with silentCheckSsoRedirectUri). Datadog RUM keeps reporting TypeError: "[object Object]" cannot be parsed as a URL from #checkSsoSilently. Login still works, but the error surfaces as an unhandled rejection, and we've had to add a client-side filter to keep it out of our error tracking.

The one-line typeof event.data !== 'string' guard here matches what the other two message listeners in keycloak.js already do. Could a maintainer take a look? It would let us drop our workaround. Thanks!

@tomsontom
tomsontom commented Oct 21, 2026
Copy link
Copy Markdown

I created a more complex patch in #370 because just checking for string is not enough because extensions like dragon also post strings

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jonkoops jonkoops Awaiting requested review from jonkoops jonkoops is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Unhandled TypeError: "[object Object]" cannot be parsed as a URL in #checkSsoSilently messageCallback when a non-string postMessage arrives

3 participants

@SAY-5 @ylligashi @tomsontom
0