You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
v26 Cross-Client SSO Failure: Cookies Ignore SameSite=None in iFrame Flow
#40066
After upgrading to Keycloak 26, our cross-client authentication flow fails because session cookies persistently default to SameSite=Lax despite explicit configuration, breaking iFrame functionality between two clients in the same realm.
DevTools shows all Keycloak cookies (AUTH_SESSION_ID, KEYCLOAK_IDENTITY, etc.) have:
Secure: true
SameSite: Lax
Adding host=xx-ourdomain.dev.io and switching KC_PROXY_HEADERS=forwarded → same result (cookies still Lax).
Am I missing an extra flag that forces Keycloak to treat the connection as HTTPS when KC_PROXY=edge is set?
Has anyone successfully implemented cross-client iFrame auth in v26?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Description:
After upgrading to Keycloak 26, our cross-client authentication flow fails because session cookies persistently default to SameSite=Lax despite explicit configuration, breaking iFrame functionality between two clients in the same realm.
Environment:
Domains:
Keycloak.conf
KC_FRONTEND_URL=https://xx-ourdomain.dev.io/auth
KC_HOSTNAME=https://xx-ourdomain.dev.io/auth
KC_HOSTNAME_BACKCHANNEL_DYNAMIC=false
KC_HOSTNAME_STRICT=false
KC_HOSTNAME_URL=https://xx-ourdomain.dev.io/auth
KC_HTTP_ENABLED=true
KC_HTTP_RELATIVE_PATH=/auth
KC_LOG_LEVEL=debug
KC_PROXY_HEADERS=xforwarded
KC_STRICT_HOSTNAME=false
KC_TRANSACTION_XA_ENABLED=false
PROXY_ADDRESS_FORWARDING=true
KC_HTTP_COOKIE_SAME_SITE=none
KC_HTTP_COOKIE_DOMAIN=.dev.io
KC_HTTP_COOKIE_SECURE=true
Observed Behavior
Adding host=xx-ourdomain.dev.io and switching KC_PROXY_HEADERS=forwarded → same result (cookies still Lax).
Am I missing an extra flag that forces Keycloak to treat the connection as HTTPS when KC_PROXY=edge is set?
Has anyone successfully implemented cross-client iFrame auth in v26?
All reactions