keycloak-developers

Verify message comes from loginIframe In the current implementation …

4/4/2017 6:32:21 PM

a message coming from any window on the same origin may cause the refresh token to be cleared.
In my case, messages generated by a chrome extension were causing the application to logout unexpectedly. With additional condition only messages coming from the login iFrame will be processed. Another suggestion would be changing the condition `event.data != "unchanged"` to something more specific.

diego0020

Commit: d2e6c14

Tree: 58e9e4e

Parents: e1f9ab9

Changes

adapters/oidc/js/src/main/resources/keycloak.js 3(+2 -1)

Details

adapters/oidc/js/src/main/resources/keycloak.js 3(+2 -1)

diff --git a/adapters/oidc/js/src/main/resources/keycloak.js b/adapters/oidc/js/src/main/resources/keycloak.js
index 2def1e2..427bd07 100755
--- a/adapters/oidc/js/src/main/resources/keycloak.js
+++ b/adapters/oidc/js/src/main/resources/keycloak.js
@@ -832,9 +832,10 @@
             document.body.appendChild(iframe);
 
             var messageCallback = function(event) {
-                if (event.origin !== loginIframe.iframeOrigin) {
+                if ((event.origin !== loginIframe.iframeOrigin) || (loginIframe.iframe.contentWindow !== event.source)) {
                     return;
                 }
+                
 
                 if (event.data != "unchanged") {
                     kc.clearToken();