redirect_uri with # has wrong redirect

Describe the bug

When request endpoint /auth/realms/realm-name/protocol/openid-connect/auth with # on url, the redirect merge querystring and hash params. Nowadays is common SPA applications use # on URL to make hash-based routing

Impact

The only safe way to use keycloak-js is to initialize before any router behavior.

• It impossible to use bundle size on keycloak stuff
• create an instance of keycloak in pages that are not necessarily needed.

Version

15.0.2

Expected behavior

Redirect with query string, and hash independently

curl 'https://keycloak-url/auth/realms/realm-name/protocol/openid-connect/auth?client_id=clientId&redirect_uri=https%3A%2F%2Fapplication-url%2F%23%2Finternal%2Furl&state=secret-state&response_mode=fragment&response_type=code&scope=openid&nonce=secret-nonce&prompt=none' -H 'cookie: cookies' -i

HTTP/2 302 
date: Mon, 29 Nov 2021 19:47:43 GMT
content-length: 0
location: https://application-url/#/internal/url?state=secret-state&session_state=secret-session&code=secret-code

Actual behavior

Redirect with query string, and hash merged independently

> curl 'https://keycloak-url/auth/realms/realm-name/protocol/openid-connect/auth?client_id=clientId&redirect_uri=https%3A%2F%2Fapplication-url%2F%23%2Finternal%2Furl&state=secret-state&response_mode=fragment&response_type=code&scope=openid&nonce=secret-nonce&prompt=none' -H 'cookie: cookies' -i

HTTP/2 302 
date: Mon, 29 Nov 2021 19:47:43 GMT
content-length: 0
location: https://application-url/#/internal/url&state=secret-state&session_state=secret-session&code=secret-code

How to Reproduce?

Request auth/realms/realm-name/protocol/openid-connect/auth with valid params, example with mocked params:

curl 'https://keycloak-url/auth/realms/realm-name/protocol/openid-connect/auth?client_id=clientId&redirect_uri=https%3A%2F%2Fapplication-url%2F%23%2Finternal%2Furl&state=secret-state&response_mode=fragment&response_type=code&scope=openid&nonce=secret-nonce&prompt=none' -H 'cookie: cookies' -i

Anything else?

More about hash router: https://krasimirtsonev.com/blog/article/deep-dive-into-client-side-routing-navigo-pushstate-hash

[Heromyth]

The problem solved when adding client new address into keycloak admin clients page. Anyone can refer to link.

It’s just that your problem is solved. It also works with the Valid Redirect URI field set to *.

This bug is still there. It’s a different bug.

[Heromyth]

We are using Keycloak 16.1.0. Suffering from this bug.