Repository navigation
Secure cookies with keycloak behind a reverse proxy that does TLS termination #46211
|
My keycloak runs behind a reverse proxy that does the TLS termination - and thereforce keycloak itself runs with KC_HTTP=true.
Now I need to initiatize an auth-flow from inside an iframe. Therefore the Auth-Flow-Cookies (e.g. AUTH_SESSION_ID) need to have "SameSite=None" and "secure". But actually I get a "SameSite=Lax". It seems that currently it is not possible to get "secure"/"SameSite=None" cookies when keyloak is running behind a reverse proxy that does the TSL termination ...? If that's the case - I would like to propose that the following code to determine whether "secure" cookies may be used should be extended to also respect any proxy headers (X-Forwarded-Proto) that are present. Or am I missing something and my problem lies somewhere else? |
Replies: 1 comment
|
ok - solved ...
|
ok - solved ...
I was missing that its nescessary to also set
KC_PROXY_HEADERS: xforwarded