[GH-ISSUE #100] Keycloak session timeout doesn’t trigger logout — app remains connected until token error #53

New issue

Closed

opened 2026-05-07 00:18:25 +02:00 by BreizhHardware · 1 comment

BreizhHardware commented

2026-05-07 00:18:25 +02:00

Owner

Originally created by @morb3at on GitHub (Nov 10, 2025).
Original GitHub issue: https://github.com/glenndehaan/unifi-voucher-site/issues/100

Originally assigned to: @glenndehaan on GitHub.

The problem

When using the UniFi Voucher Docker app integrated with Keycloak for authentication, user sessions are not being invalidated on the application side after the Keycloak SSO session expires.

Currently, when the Keycloak session times out (e.g., after 30 minutes of inactivity), the app continues running as if still authenticated. Once a new request is made, it fails with the following error:

OPError: invalid_token (Token verification failed) at throwAuthenticateErrors (/app/node_modules/openid-client/lib/helpers/process_response.js:18:11) at processResponse (/app/node_modules/openid-client/lib/helpers/process_response.js:41:7) at Client.userinfo (/app/node_modules/openid-client/lib/client.js:1135:18)

This causes the interface to appear disconnected without any visible logout or redirect for the user.

Expected Behavior

When the Keycloak session expires or the token becomes invalid, the app should automatically:

Terminate the local session.
Redirect the user to the main login page (or homepage).
Optionally, receive a logout notification from Keycloak (frontchannel or backchannel logout).

Actual Behavior

The app remains active after the Keycloak SSO session expires.
User sees a silent disconnect followed by an invalid_token error in logs.
No automatic logout or redirect happens.

Steps to Reproduce

Log in via Keycloak.
Leave the session idle until Keycloak session times out (e.g., 30 minutes).
Try to perform any action in the app.
Observe the invalid_token error and disconnection.

Environment

App: UniFi Voucher Docker
Auth Provider: Keycloak (OIDC)
Access Token Lifespan: 5 minutes
SSO Session Idle Timeout: 30 minutes
Keycloak Version: [latest]
App Version: [latest]

Suggested Fix

Implement proper Frontchannel or Backchannel Logout handling in the app so Keycloak can notify it when the user session expires.

Alternatively, add a mechanism to detect expired sessions and redirect users to the login page automatically.

What version of UniFi Voucher Site has the issue?

8.3.0

What was the last working version of UniFi Voucher Site?

No response

What type of installation are you running?

Docker

Anything in the logs that might be useful for us?

OPError: invalid_token (Token verification failed)
    at throwAuthenticateErrors (/app/node_modules/openid-client/lib/helpers/process_response.js:18:11)
    at processResponse (/app/node_modules/openid-client/lib/helpers/process_response.js:41:7)
    at Client.userinfo (/app/node_modules/openid-client/lib/client.js:1135:18)

Additional information

No response

Originally created by @morb3at on GitHub (Nov 10, 2025). Original GitHub issue: https://github.com/glenndehaan/unifi-voucher-site/issues/100 Originally assigned to: @glenndehaan on GitHub. ### The problem When using the UniFi Voucher Docker app integrated with Keycloak for authentication, user sessions are not being invalidated on the application side after the Keycloak SSO session expires. Currently, when the Keycloak session times out (e.g., after 30 minutes of inactivity), the app continues running as if still authenticated. Once a new request is made, it fails with the following error: `OPError: invalid_token (Token verification failed) at throwAuthenticateErrors (/app/node_modules/openid-client/lib/helpers/process_response.js:18:11) at processResponse (/app/node_modules/openid-client/lib/helpers/process_response.js:41:7) at Client.userinfo (/app/node_modules/openid-client/lib/client.js:1135:18)` This causes the interface to appear disconnected without any visible logout or redirect for the user. Expected Behavior When the Keycloak session expires or the token becomes invalid, the app should automatically: - Terminate the local session. - Redirect the user to the main login page (or homepage). - Optionally, receive a logout notification from Keycloak (frontchannel or backchannel logout). Actual Behavior - The app remains active after the Keycloak SSO session expires. - User sees a silent disconnect followed by an invalid_token error in logs. - No automatic logout or redirect happens. Steps to Reproduce 1. Log in via Keycloak. 2. Leave the session idle until Keycloak session times out (e.g., 30 minutes). 3. Try to perform any action in the app. 4. Observe the invalid_token error and disconnection. Environment - App: UniFi Voucher Docker - Auth Provider: Keycloak (OIDC) - Access Token Lifespan: 5 minutes - SSO Session Idle Timeout: 30 minutes - Keycloak Version: [latest] - App Version: [latest] Suggested Fix Implement proper Frontchannel or Backchannel Logout handling in the app so Keycloak can notify it when the user session expires. Alternatively, add a mechanism to detect expired sessions and redirect users to the login page automatically. ### What version of UniFi Voucher Site has the issue? 8.3.0 ### What was the last working version of UniFi Voucher Site? _No response_ ### What type of installation are you running? Docker ### Anything in the logs that might be useful for us? ```Text OPError: invalid_token (Token verification failed) at throwAuthenticateErrors (/app/node_modules/openid-client/lib/helpers/process_response.js:18:11) at processResponse (/app/node_modules/openid-client/lib/helpers/process_response.js:41:7) at Client.userinfo (/app/node_modules/openid-client/lib/client.js:1135:18) ``` ### Additional information _No response_

BreizhHardware

2026-05-07 00:18:25 +02:00

closed this issue
added the
bug
label

BreizhHardware commented

2026-05-07 00:18:26 +02:00

Author

Owner

@glenndehaan commented on GitHub (Nov 11, 2025):

Hi @morb3at,

I have just released version 8.3.1.
This resolves the issue you are encountering where the system can't fetch user data if the token has expired.
Since this function was not caught before it would leave users stuck on an error page.
This has been fixed and tested against the following scenarios:

Token expires
SSO session expires
User logs out via idP
User is deactivated via idP

For now I don't see the need for front/back channel logout methods.
One last note for myself: front channel logout is not supported by the dependency

Kind regards,
Glenn de Haan

@glenndehaan commented on GitHub (Nov 11, 2025): Hi @morb3at, I have just released version 8.3.1. This resolves the issue you are encountering where the system can't fetch user data if the token has expired. Since this function was not caught before it would leave users stuck on an error page. This has been fixed and tested against the following scenarios: - Token expires - SSO session expires - User logs out via idP - User is deactivated via idP For now I don't see the need for front/back channel logout methods. One last note for myself: front channel logout is not supported by the dependency Kind regards, Glenn de Haan