Tags: keycloak/keycloak

Discard an authorization response the console did not request

An organization invitation for a new user completes an authorization code
flow whose response is delivered to the account console, a page belonging to
a different client and unable to exchange the code. The request carries no
state, so keycloak-js does not recognize the response as a callback and
leaves code, session_state and iss in the browser URL. It then starts its own
login with redirect_uri defaulting to that URL, which the server rejects for
carrying OIDC response parameters, leaving the page unable to log in at all.

Remove those parameters before keycloak-js reads the URL. They are discarded
only when code or error appears without state, a shape the adapter's own
requests never produce, so a genuine callback is left untouched.

Fixes #52157

Signed-off-by: Stan Silvert <ssilvert@redhat.com>
Assisted-by: Claude Opus 5

Set version to 26.7.4

Set version to 26.6.7

Signed-off-by: stianst <stianst@gmail.com>

Set version to 26.4.16

Signed-off-by: stianst <stianst@gmail.com>

Set version to 26.7.3

Set version to 26.7.2

Set version to 26.6.6

Signed-off-by: stianst <stianst@gmail.com>

Set version to 26.4.15

Signed-off-by: stianst <stianst@gmail.com>

Set version to 26.7.1

Set version to 26.6.5

Signed-off-by: stianst <stianst@gmail.com>