从Keycloak登出时遇431错误，如何修改最大请求头大小？

问题原因 #

拥有260个角色的用户的ID Token包含大量角色声明，体积远超普通用户。当前用GET请求将id_token_hint作为URL参数传递，导致整个请求URI长度超过Keycloak服务器的限制，触发431 Request Header Fields Too Large错误。你之前配置的server.max-http-request-header-size等参数是针对自身Spring Boot应用作为服务器时的限制，对作为客户端向Keycloak发送请求的场景无效。

解决方案：改用POST请求发送登出请求 #

Keycloak的OIDC登出接口支持POST方法，将参数放在请求体中可以避免URI过长的问题。修改你的KeycloakLogoutHandler代码如下：

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.http.HttpEntity;
import org.springframework.http.HttpHeaders;
import org.springframework.http.MediaType;
import org.springframework.security.core.Authentication;
import org.springframework.security.oauth2.core.oidc.user.OidcUser;
import org.springframework.security.web.authentication.logout.LogoutHandler;
import org.springframework.util.LinkedMultiValueMap;
import org.springframework.util.MultiValueMap;
import org.springframework.web.client.RestTemplate;
import org.springframework.web.client.RestTemplateBuilder;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;

@Component
public class KeycloakLogoutHandler implements LogoutHandler {

    private final RestTemplate restTemplate;
    private static final Logger log = LoggerFactory.getLogger(KeycloakLogoutHandler.class);

    @Autowired
    public KeycloakLogoutHandler(RestTemplateBuilder builder) {
        this.restTemplate = builder.build();
    }

    @Override
    public void logout(HttpServletRequest request, HttpServletResponse response, Authentication auth) {
        logoutFromKeycloak((OidcUser) auth.getPrincipal());
    }

    private void logoutFromKeycloak(OidcUser user) {
        String endSessionEndpoint = user.getIssuer() + "/protocol/openid-connect/logout";
        
        // 设置请求头为表单格式
        HttpHeaders headers = new HttpHeaders();
        headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
        
        // 构造表单参数
        MultiValueMap<String, String> params = new LinkedMultiValueMap<>();
        params.add("id_token_hint", user.getIdToken().getTokenValue());
        
        HttpEntity<MultiValueMap<String, String>> requestEntity = new HttpEntity<>(params, headers);
        
        // 发送POST请求
        ResponseEntity<String> logoutResponse = restTemplate.postForEntity(endSessionEndpoint, requestEntity, String.class);
        if (logoutResponse.getStatusCode().is2xxSuccessful()) {
            log.info("Successfully logged out from Keycloak");
        } else {
            log.error("Could not propagate logout to Keycloak");
        }
    }
}

额外说明 #

如果确实需要使用GET请求（不推荐），可以调整Keycloak服务器的配置：

• 对于Keycloak默认使用的Undertow服务器，在standalone.xml或domain.xml中修改http-listener节点的max-query-size参数，增大允许的查询字符串长度。
• 但POST方案更符合HTTP规范，也能从根本上避免URI长度受限的问题。

内容的提问来源于stack exchange，提问作者Octavia