# How to break infinite redirect loop on Keycloak Authorization Code Flow error (before token exchange)? **URL:** \ **Category:** Getting advice\ **Tags:** authentication\ **Created:** [May 20, 2025, 5:43pm UTC](https://forum.keycloak.org/t/how-to-break-infinite-redirect-loop-on-keycloak-authorization-code-flow-error-before-token-exchange/30021 "2025-05-20T17:43:14Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![carlosrodovalho](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/carlosrodovalho/32/12110_2.png) [@carlosrodovalho](https://forum.keycloak.org/u/carlosrodovalho)\ **Post date:** [May 20, 2025, 5:43pm UTC](https://forum.keycloak.org/t/how-to-break-infinite-redirect-loop-on-keycloak-authorization-code-flow-error-before-token-exchange/30021/1 "2025-05-20T17:43:14Z")
Hi all, I’m using Keycloak with the Authorization Code Flow in my PHP application. The flow works like this: 1. User authenticates on Keycloak. 2. Keycloak redirects to my app with only the `code` parameter. 3. My app exchanges the code for tokens (`access_token`, `id_token`, etc.) using the Keycloak token endpoint. **The problem:** If an error occurs **after** I get the tokens, I can use `id_token_hint` to log the user out of Keycloak and redirect them to the login page, which works fine. But if an error occurs **during the code exchange** (i.e., after receiving the code but before getting any tokens), I don’t have the `id_token`, so I can’t log the user out of Keycloak. If I simply redirect the user back to the Keycloak login page, Keycloak detects the active session and immediately redirects back to my app with a new code, causing an infinite redirect loop. **Question:** What is the proper way to handle errors that happen after receiving the authorization code, but before obtaining the tokens, so I can break this loop and allow the user to try authenticating again? Any best practices or recommended approaches for this scenario? ---
**Author:** ![embesozzi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/embesozzi/32/12390_2.png) [@embesozzi](https://forum.keycloak.org/u/embesozzi)\ **Post date:** [May 26, 2025, 12:23pm UTC](https://forum.keycloak.org/t/how-to-break-infinite-redirect-loop-on-keycloak-authorization-code-flow-error-before-token-exchange/30021/2 "2025-05-26T12:23:27Z")
You are in an edge case, because if you’re not able to exchange the authorization code for a token, it’s usually due to a misconfiguration in the application. However, as a way to force the login, you can use the standard `prompt=login` [1], which will make the IdP prompt for login again. [1] [Final: OpenID Connect Core 1.0 incorporating errata set 2](https://openid.net/specs/openid-connect-core-1_0.html) ---
**Author:** ![carlosrodovalho](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/carlosrodovalho/32/12110_2.png) [@carlosrodovalho](https://forum.keycloak.org/u/carlosrodovalho)\ **Post date:** [May 26, 2025, 1:25pm UTC](https://forum.keycloak.org/t/how-to-break-infinite-redirect-loop-on-keycloak-authorization-code-flow-error-before-token-exchange/30021/3 "2025-05-26T13:25:44Z")
Thank you! Forcing the prompt login is exactly what i need! And yes, I understand that this situation should not happen normally, but as I’m trying to handle every possible error during the flow. ---
**Author:** ![embesozzi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/embesozzi/32/12390_2.png) [@embesozzi](https://forum.keycloak.org/u/embesozzi)\ **Post date:** [May 26, 2025, 5:15pm UTC](https://forum.keycloak.org/t/how-to-break-infinite-redirect-loop-on-keycloak-authorization-code-flow-error-before-token-exchange/30021/4 "2025-05-26T17:15:46Z")
Glad to help! But remember, keep things as simple as possible! ---
**Author:** ![bpedersen2](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/bpedersen2/32/3934_2.png) [@bpedersen2](https://forum.keycloak.org/u/bpedersen2)\ **Post date:** [May 27, 2025, 6:58am UTC](https://forum.keycloak.org/t/how-to-break-infinite-redirect-loop-on-keycloak-authorization-code-flow-error-before-token-exchange/30021/5 "2025-05-27T06:58:50Z")
Maybe you should revisit what you do in case of such an error by looking at what would cause the error (realistically): 1. keycloak crashed → you would need to wait for the restart anyway, so just hint the user to try later 2. a network error from your app server to keycloak → again, a fatal error 3. app/keycloak configuration error → again this would not magically resolve itself So i think that this error case should be handled on the app side with an `auth service is not available, try again later` error message. ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [May 27, 2025, 7:58am UTC](https://forum.keycloak.org/t/how-to-break-infinite-redirect-loop-on-keycloak-authorization-code-flow-error-before-token-exchange/30021/6 "2025-05-27T07:58:27Z")
To bring a little bit more “fun” to this: I had this “infinite redirect loop” several times in conjunction with either old/invalid cookies and/or the hidden iframe. The latter only when using in JS-based apps with the JS-adapter. ---
**Author:** ![carlosrodovalho](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/carlosrodovalho/32/12110_2.png) [@carlosrodovalho](https://forum.keycloak.org/u/carlosrodovalho)\ **Post date:** [May 27, 2025, 12:10pm UTC](https://forum.keycloak.org/t/how-to-break-infinite-redirect-loop-on-keycloak-authorization-code-flow-error-before-token-exchange/30021/7 "2025-05-27T12:10:40Z")
Thanks @bpedersen2 . This was a force error, just trying to handle a possible network instability gracefully. Now I understand that I must redirect the user somewhere else, or use prompt=login to stop the loop. I customized Keycloak’s login theme to show custom error messages, so now it works as intended. A huge thanks to this comunity. Keycloak is a wonderfull tool and it’s been very nice to learn from you guys.