session_code - tips?

[Francis Augusto Medeiros]

Hi,

I work on a Keycloak extension to allow push notifications as a 2FA.

I am facing a little problem:

It seems to me that Keycloak doesn’t allow me to send an authentication form with the same session_code twice - at least this is my impression.

I usually get a new session code from the response, so this is not a huge problem, except with mobile clients in iOS and Android, because when the user swipes out to the app in order to approve the login, the HTTP call gets aborted by the OS, so I don’t get a new session_code. Reusing the previous doesn’t work, as I said.

Is there any way to overcome this?

Best,

Francis