Repository navigation
|
Keycloak "silent" check-sso feature is no longer supported by several browsers because it relies on 3rd party cookies (3PC): When relying on check-sso it causes redirection for every login check, which is causing a bad user experience, and performance for the app decreases when not used. This specifically pertains to Chrome, that is planning to deprecate support for 3PC by 2025. Are there plans to migrate to other ways to support this feature using other mechanisms like CHIPS, Storage Access API etc. ? This was a great feature when it was supported by browsers, and it would be excellent to find an alternative. |
Replies: 1 comment 2 replies
|
We're evaluating FedCM, but the work is currently stalled (see #16834). We already call the Storage Access API, but it cannot ask for user consent in an iframe (without visible user interaction), so its use is limited. CHIPS also has caveats, as it will force partitioning, so we cannot handle single sign-out, or detect user sessions across multiple domains. Basically all the things that are being pushed as a solution are either still in development by browsers, or don't solve the whole problem. Note also that Chrome-based browsers are the only ones implementing most of these APIs and for the APIs that are implemented cross-browser are done so with inconsistent behaviour. We have introduced a fallback to a regular redirect flow in case third-party cookies are not supported, which is not ideal, but it prevents things from breaking catastrophically. In the mean time, we are waiting for browser vendors (especially Chrome) to give us a stable API that can work cross-browser with established standards. |
We're evaluating FedCM, but the work is currently stalled (see #16834). We already call the Storage Access API, but it cannot ask for user consent in an iframe (without visible user interaction), so its use is limited. CHIPS also has caveats, as it will force partitioning, so we cannot handle single sign-out, or detect user sessions across multiple domains.
Basically all the things that are being pushed as a solution are either still in development by browsers, or don't solve the whole problem. Note also that Chrome-based browsers are the only ones implementing most of these APIs and for the APIs that are implemented cross-browser are done so with inconsistent behaviour.
We have introduce…