Incorrect redirect url after login

Securing applications
1

I have application with spring boot as back end and angular front end. I am using keycloak sprint boot adapter for security.

I have configured /sso/login as redirect uri. When I hit the app url it redirect to keycloak authentication page When I fill up user name and password and it redirected back to application.
I have exposed one more api /token to get the token on the angular front end.

This setup works fine most of the cases. But some time after login it redirect to /token instead of my application. This happens mostly when my session get time out. When I debug the network, I see after authentication successful /sso/login is redirect to /token . I am not sure how it gets the token url

https://myserver.com/portal/sso/login?state=e1a0d065-9e24-4215-a481-574714a5e25a&session_state=5b153b3d-50c3-4685-8111-bde3b2ea381d&code=5655900b-e6d5-4a91-ba67-99461e977ca0.5b153b3d-50c3-4685-8111-bde3b2ea381d.28077aae-ac67-42d2-9cec-67b2aaac83b1

Above call has 302 status with location of /token.

Let let me know /sso/login?state redirect to any url

2

You have wrong sso implementation. Frontend should maintain valid state of the token (token refresh included). Backend will receive valid unexpired token, so it won’t redirect to aith/ login screen (but in better backend implementation it shouldn’t redirect, it should return only 401 response to indicate auth problem).