3759752 - Oauth2/pkce Login Fails After Session Timeout in Composable Storefront

During the upgrade to SAP Commerce 2211 (JDK 21.10) together with Spartacus 2211 21.10.x, it was identified an issue related to the OAuth2/PKCE authorization flow on the Spartacus login page.

When a user opens the Spartacus login page and remains inactive for longer than the timeout configured in the following property:

authorizationserver.session.timeout

any subsequent login attempt fails.

At that point, the browser enters a redirect loop between the Spartacus login page and /authorizationserver/login, eventually resulting in a 403 Forbidden response returned by the Authorization Server.

At the time of the error, the URL is:

https://<host>/authorizationserver/login

The network trace shows multiple 302 redirects cycling between:

/authorizationserver/authorize?response_type=code&client_id=oauth_<...>&code_challenge_method=S256

and

/authorizationserver/login

before finally ending with a 403 Forbidden response.

• SAP Commerce Cloud 2211 for JDK 21
• SAP Commerce Cloud, Composable Storefront

oauth2, pkce, login, issue, spartacus, redirect, loop, authorizationserver, 403, forbidden, server, csrf, ccv2, cloud , KBA , CEC-SPA , SAP Commerce Cloud Spartacus , Known Error