Repository navigation
Can Keycloak Share Cookies with Different Domains? #36736
Replies: 4 comments 2 replies
|
As long as you are in the same browser profile, I'm fairly sure you should be able to log in to Keycloak without having to reauthenticate. However, if you do not enable the "Remember me" option, I think Keycloak stores the authentication tokens in non-persistent storage (i.e., not in cookies) which depending on the implementation (e.g., session storage) may not be shared between tabs. Not using the "Remember me" option certainly results in having to reauthenticate if the browser is closed. |
|
@darius-m Can you please explain what you mean by same browser profile? I logged into https://my-uat.ant.en/ in one browser window and without closing the browser, I opened a new tab and opened https://myawesomeapp.com/ant/ and it redirects me to keycloak login page instead of automatically logging in? I deployed another website on same domain as https://my-uat.ant.en/ and it works fine without asking me to relogin. Also the Remember Me option is already enabled in keycloak One more thing which I tried is I logged in https://my-uat.ant.en/ and in the same tab itself I opened https://myawesomeapp.com/ant/ and still it asks me to login again |
|
Browser profiles allow you to create multiple browser settings using the same browser (e.g., you could have a profile that uses a SOCKS proxy, while another does not), or have completely separate information stores (e.g., cookies) for sites. For Chrome you have an integration in the browser's menu, while in Firefox you can use Now, for the issue that you have mentioned, there may be some misconfiguration. If you are able to log in to a different service on the same domain and it works (by this I mean that the two services on A small clarification - when being asked to log in when coming from |
|
@darius-m Thanks for the reply. I tried looking into console logs as well as Keycloak logs, everything looks ok to me. yes I see the full login prompt like this |
|
In this case, it's probably a misconfiguration issue. If I'm not mistaken, the Keycloak logo is only displayed on the master realm's login page. Are you sure the application redirects to the correct realm for login? The master realm is for administration only, and other clients should be placed in a different realm. |
|
I have the same needs, I have keycloak at https://account.example.com and application in https://example.com. But I can't read the cookie generated by keycloak. I am using the public client with keycloak-js. I am wondering if it is possible to share the cookie with my application backend. Or what is the recommended way to inform the backend about the login/authentication status of the user? For the API, which is usually called with axios/fetch/ajax etc, we can add the access token to the Authorization header, which is fine. But when it comes to protecting a static page, e.g.: , I want to host a protected HTML page. How should I proceed? Because when someone enters the URL, there is no authorization header, only the cookie can be sent automatically by the browser. Any advice or suggestion would be very helpful! |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Before reporting an issue
Area
No response
Describe the bug
I have a website eg: https://my-uat.ant.en/ (just an example domain and not real one) and then I have integrated it with keycloak and it works fine, the keycloak domain is at e.g. https://auth-uat.ant.en/realms/master/protocol/openid-connect........ (just an example domain and not real one)
Now I have a different website eg: https://myawesomeapp.com/ant/ and it has also integrated with keycloak located at https://auth-uat.ant.en
Now I first sign in to https://my-uat.ant.en with keycloak and then in a separate browser tab I open https://myawesomeapp.com/ant/ which does not maintain my keycloak session and it asks me to sign in again? The sign in works but why do I need to sign in again given that I already signed with keycloak for https://my-uat.ant.en. Why is this?
Is it due to difference in domain or am I missing any settings?
Both domain uses the same client, same realm, all the same settings on keycloak
Version
26.1.0
Regression
Expected behavior
Keycloak should be able to maintain session for websites integrated with it even if the domain is different
Actual behavior
Keycloak does not maintain session for websites integrated with it as the domain is different
How to Reproduce?
Create a website and deploy to aws and integrate keycloak with it, make sure the domain for website and keycloak is same.
Create another website and deploy to aws with different domain but allow the website to login with keycloak located on the first website's domain
Anything else?
No response
All reactions