javascript - what does state, session_state, and code url paremeters from a keycloak redirect represent? - Stack Overflow

admin管理员组

文章数量:1427340

What does the state, session_state and code url parameters represent in the url string after getting a redirect after logging in via keycloak?

I do keycloak.init to require a login and get redirected to the ChatPage portion of my react app:

this.state.appKeycloak.init({
    onLoad: 'login-required',
    redirectUri: 'http://localhost:3000/ChatPage'
})

After logging in to my local react app on http://localhost:3000 I see this in the URL:

http://localhost:3000/ChatPage#state=7....1&session_state=e...70&code=c...f6

What does the state, session_state, and code fields represent? Do any of them have the token I can decode to get the users login information?

What does the state, session_state and code url parameters represent in the url string after getting a redirect after logging in via keycloak?

I do keycloak.init to require a login and get redirected to the ChatPage portion of my react app:

this.state.appKeycloak.init({
    onLoad: 'login-required',
    redirectUri: 'http://localhost:3000/ChatPage'
})

After logging in to my local react app on http://localhost:3000 I see this in the URL:

http://localhost:3000/ChatPage#state=7....1&session_state=e...70&code=c...f6

What does the state, session_state, and code fields represent? Do any of them have the token I can decode to get the users login information?

• javascript
• reactjs
• keycloak

Share Improve this question Follow asked Sep 20, 2023 at 2:11 CAMD_3441CAMD_3441 3,21444 gold badges2929 silver badges4141 bronze badges

Add a ment  | 

2 Answers 2

Sorted by: Reset to default 3

No, none of them do. Those are all parameters from various standards.

code is used for authorization code flow to exchange for the tokens at the token endpoint. You can get the access_token, refresh_token and id_token at the token endpoint by using the code.

state is used to prevent CSRF attacks either by attackers initiating requests to the authorization endpoint or forging responses to the application redirect endpoint.

session_state is part of the OpenID Connect Session Management specification where you use an iframe to check if the SSO user has logged out for instance.

Likely what you really want to know is the following

const authenticated = await keycloak.init({
    onLoad: 'login-required',
    redirectUri: 'http://localhost:3000/ChatPage'
});
if(authenticated) {
    console.log(keycloak.token);
    console.log(keycloak.tokenParsed);
    console.log(keycloak.idToken);
    console.log(keycloak.idTokenParsed);
    console.log(keycloak.refreshToken);
    console.log(keycloak.refreshTokenParsed);
    console.log(keycloak.sessionId);
    console.log(keycloak.subject);
    console.log(keycloak.realmAccess);
    console.log(keycloak.resourceAccess);
}

本文标签：