keycloak/keycloak
CORS Header missing when accessing /account endpoint with an expired session
Ouverte
#47 934 ouverte le 10 avr. 2026
area/account/apihelp wantedkind/bugpriority/lowstatus/auto-bumpstatus/auto-expireteam/core-clientsteam/core-shared
Métriques du dépôt
- Stars
- (34 398 étoiles)
- Métriques de merge PR
- (Métriques PR en attente)
Description
Before reporting an issue
- I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
account/api
Describe the bug
When a user session ends (e.g. by using the session limit) and loadUserProfile() (on the Keaycloak js-adapter) is called, it does not result in an 401 error but in a low level TypeError caused by CORS. The result is: The user is redirected to a low level error page instead of the login page. When we look at the actual request, we see, that the request to /account results in a 401 but with missing CORS headers. Because of this, the 401 is ignored by the browser and a TypeError is thrown.
Version
26.6.0
Regression
- The issue is a regression
Expected behavior
TypeError is thrown
Actual behavior
401 can be handled correctly
How to Reproduce?
End the users session in Keycloak and call loadUserProfile() in the frontend.
Anything else?
No response