Skip to content

fix: allows verify email working in incognito browser tab after Keycloak restart#51089

Open
pchorus wants to merge 1 commit into
keycloak:mainfrom
pchorus:feature/fix-verify-email
Open

fix: allows verify email working in incognito browser tab after Keycloak restart#51089
pchorus wants to merge 1 commit into
keycloak:mainfrom
pchorus:feature/fix-verify-email

Conversation

@pchorus

@pchorus pchorus commented Jul 22, 2026

Copy link
Copy Markdown

Avoid NullPointerException.

Closes #51088.

@pchorus
pchorus requested a review from a team as a code owner July 22, 2026 12:09
Copilot AI review requested due to automatic review settings July 22, 2026 12:09
@pchorus
pchorus force-pushed the feature/fix-verify-email branch from 1a8fcce to f84de65 Compare July 22, 2026 12:10

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Prevents email verification from failing after a Keycloak restart when the original authentication session no longer exists.

Changes:

  • Adds a null guard before removing the original root authentication session.

Copilot AI review requested due to automatic review settings July 22, 2026 12:11

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

services/src/main/java/org/keycloak/authentication/actiontoken/verifyemail/VerifyEmailActionTokenHandler.java:142

  • Please add a regression test for the missing-root-session path. The existing RequiredActionEmailVerificationTest.verifyEmailRegisterWithSecondBrowser keeps the original root authentication session alive, so it would not catch this NPE returning after a restart; the test should remove/expire that session before opening the email link in the second browser and assert successful verification.
            if (rootAuthSession != null) {
                session.authenticationSessions().removeRootAuthenticationSession(realm, rootAuthSession);
            }

@pchorus
pchorus force-pushed the feature/fix-verify-email branch from f84de65 to a9ff644 Compare July 24, 2026 06:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Verify email not working in incognito browser tab after Keycloak restart

2 participants