47745 : [Enhancement] Make cookie name prefix configurable for seamless blue-green migrations #47775

bkoragan · 2026-04-06T01:59:58Z

bkoragan
Apr 6, 2026

I would like to confirm a few design decisions on this 47745 enhancement - before I open a PR for review on this enhancement. Can you pls review these and clarify ?

Default is empty string (no prefix) — meaning, existing deployments are completely unaffected. Only administrators who explicitly set the config get prefixed cookies?
Prefix applies to ALL cookies uniformly — Including legacy/unused cookies (AUTH_SESSION_ID_LEGACY, etc.) and 3. WELCOME_STATE_CHECKER. No cookie is exempt. Is there any cookie that should be excluded from prefixing?
No fallback to unprefixed cookie names on read — If prefix is KC26_, the provider will ONLY look for KC26_KEYCLOAK_SESSION, never KEYCLOAK_SESSION. This gives clean isolation but means enabling the prefix is a hard cutover for that instance (existing unprefixed sessions won't be found). The issue explicitly asks for isolation, so this seems correct ? — but would like to confirm since a fallback-on-read approach would allow a softer migration at the cost of weaker isolation.
No validation on the prefix value — We trust administrators to use valid cookie-name characters per spec#RFC 6265. We could add a startup check that rejects characters like ;, =, spaces, etc. Is this worth adding now or as a follow-up?
Configuration via SPI property, not a top-level http-cookie-prefix option — The config would be --spi-cookie-default-cookie-prefix=KC26_ (or env var KC_SPI_COOKIE_DEFAULT_COOKIE_PREFIX). This seems follows the existing SPI config pattern. However, the issue seens http-cookie-prefix as a top-level option under HttpOptions, which is be more discoverable. Which approach do you prefer?

Navigation Menu

Repository navigation

47745 : [Enhancement] Make cookie name prefix configurable for seamless blue-green migrations #47775

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

47745 : [Enhancement] Make cookie name prefix configurable for seamless blue-green migrations #47775

Uh oh!

bkoragan Apr 6, 2026

Replies: 0 comments

bkoragan
Apr 6, 2026