Summary
When multiple front-end apps share the same Keycloak realm, logging out from one app does not notify other apps running in open browser tabs. This is not a bug in oidc-spa — by design, cross-tab synchronization is scoped to the same origin and cannot work across different domains. This is a feature request to explore native frontchannel logout support as the natural solution for SPAs.
Context
We have two separate front-ends sharing the same Keycloak realm:
- A React Router v7 SPA (patient portal,
autoLogin: true) on one subdomain
- A Next.js 15 storefront (public,
oidc-spa/react-spa) on another subdomain
Both share the same top-level domain. Cross-tab sync works perfectly between tabs of the same app. The issue is cross-app: logging out in the SPA does perform a global Keycloak logout (confirmed — a hard refresh on the storefront shows the logged-out UI), but the storefront tab is not notified in real time and remains in a stale logged-in state until manually refreshed.
Why existing mechanisms don't apply
localStorage events and BroadcastChannel are scoped to the same origin — not viable cross-domain even on the same top-level domain- Backchannel logout requires a server receiving Keycloak notifications and then propagating state to the browser (WebSockets/SSE) — goes beyond the scope of oidc-spa and requires custom infrastructure
Why frontchannel logout is the natural fit
Frontchannel logout is an OIDC standard where Keycloak, upon receiving a logout request, injects hidden iframes in the logout page — one per registered client — each pointing to a configured logout URL on that client. The browser loads those iframes in the user's context, allowing each SPA to receive the notification and clear its local session state. No server required, fully configurable in Keycloak per client.
Feature request
Would it be feasible for oidc-spa to support frontchannel logout natively? This would involve:
- Exposing a handler (e.g. a route or a function) that Keycloak can call as the frontchannel logout URL for a given client
- When that handler is triggered, oidc-spa clears the local session state and updates the React state accordingly
This would make cross-app logout sync a first-class feature for multi-SPA setups on the same Keycloak realm, without requiring any backend infrastructure.
Summary
When multiple front-end apps share the same Keycloak realm, logging out from one app does not notify other apps running in open browser tabs. This is not a bug in oidc-spa — by design, cross-tab synchronization is scoped to the same origin and cannot work across different domains. This is a feature request to explore native frontchannel logout support as the natural solution for SPAs.
Context
We have two separate front-ends sharing the same Keycloak realm:
autoLogin: true) on one subdomainoidc-spa/react-spa) on another subdomainBoth share the same top-level domain. Cross-tab sync works perfectly between tabs of the same app. The issue is cross-app: logging out in the SPA does perform a global Keycloak logout (confirmed — a hard refresh on the storefront shows the logged-out UI), but the storefront tab is not notified in real time and remains in a stale logged-in state until manually refreshed.
Why existing mechanisms don't apply
localStorageevents andBroadcastChannelare scoped to the same origin — not viable cross-domain even on the same top-level domainWhy frontchannel logout is the natural fit
Frontchannel logout is an OIDC standard where Keycloak, upon receiving a logout request, injects hidden iframes in the logout page — one per registered client — each pointing to a configured logout URL on that client. The browser loads those iframes in the user's context, allowing each SPA to receive the notification and clear its local session state. No server required, fully configurable in Keycloak per client.
Feature request
Would it be feasible for oidc-spa to support frontchannel logout natively? This would involve:
This would make cross-app logout sync a first-class feature for multi-SPA setups on the same Keycloak realm, without requiring any backend infrastructure.