Reverse proxy setup cookie issue #40862

Maribhuvan · 2025-07-02T11:32:11Z

Maribhuvan
Jul 2, 2025

Before reporting an issue

I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

No response

Describe the bug

Hi, I'm using Keycloak for authentication and have set up a reverse proxy using Express.js. The redirection to my application port after login works successfully, but I'm immediately logged out afterward. It seems the issue is that cookies are not being set properly.

below is my keycloak.conf setup
kc.spi.cookies.same-site-cookie-value=None
kc.spi.cookies.secure=true
kc.spi.cookies.http-> spi-sticky-session-encoder-infinispan-should-attach-route=false
proxy=edge
proxy-address-forwarding=true
hostname=rtmcdtm4x34.local
hostname-strict=false
hostname-strict-https=false

my backend code:
const authProxy = createProxyMiddleware({
target: 'https://mydomain:8553/',
changeOrigin: true,
xfwd: true,
secure: false,
logger: console,
on: {
proxyReq: (proxyReq, req, res) => {
proxyReq.setHeader('X-Forwarded-Proto', 'https');
proxyReq.setHeader('X-Forwarded-Host', 'mydomain');
proxyReq.setHeader('X-Forwarded-Port', '9444');
proxyReq.setHeader('X-Forwarded-For', req.ip);
},
error: (err, req, res) => {
console.error('Proxy error:', err, req, res);
},
},
});

const resouceProxy = createProxyMiddleware({
target: 'https://mydomain:8553/resources',
changeOrigin: true,
xfwd: true,
secure: false,
logger: console,
on: {
proxyReq: (proxyReq, req, res) => {
proxyReq.setHeader('X-Forwarded-Proto', 'https');
proxyReq.setHeader('X-Forwarded-Host', 'mydomain');
proxyReq.setHeader('X-Forwarded-Port', '9444');
proxyReq.setHeader('X-Forwarded-For', req.ip);
},
error: (err, req, res) => {
console.error('Proxy error:', err, req, res);
},
},
});

const realmsProxy = createProxyMiddleware({
target: 'https://mydomain:8553/realms',
changeOrigin: true,
xfwd: true,
secure: false,
logger: console,
on: {
proxyReq: (proxyReq, req, res) => {
proxyReq.setHeader('X-Forwarded-Proto', 'https');
proxyReq.setHeader('X-Forwarded-Host', 'mydomain');
proxyReq.setHeader('X-Forwarded-Port', '9444');
proxyReq.setHeader('X-Forwarded-For', req.ip);
},
error: (err, req, res) => {
console.error('Proxy error:', err, req, res);
},
},
});

app.use('/auth', authProxy);
app.use('/resources', resouceProxy);
app.use('/realms', realmsProxy);

frontend code:
const keycloak = new Keycloak({
url: https://${hostname}:9444/auth,
realm: 'relamid'
clientId: 'clientid'
});

Version

26.0.1

Regression

The issue is a regression

Expected behavior

Maintain the session as its when i logged IN to my application

Actual behavior

When i logged in immediately its logged out when i checked authentication session cookies are not set properly

How to Reproduce?

after login

Anything else?

No response

Answered by shawkins

Jul 2, 2025

I can help you resolve the basic issue of hostname / proxy configuration. You should be able to use hostname debug to confirm your new settings are correct: https://www.keycloak.org/server/hostname#_troubleshooting

From there if are not seeing insecure context warnings, then your issue lies elsewhere. We can then review your spi cookie settings, the proxy handling of cookies (for example #40111 (reply in thread)), and even the browser handling

View full answer

shawkins · 2025-07-02T12:00:26Z

shawkins
Jul 2, 2025
Collaborator

These are either not used or no longer valid.

proxy=edge
proxy-address-forwarding=true
hostname-strict-https=false

Please set proxy-headers=xforwarded

See https://www.keycloak.org/server/reverseproxy

5 replies

shawkins Jul 2, 2025
Collaborator

See the docs on the reverse proxy again. If you are accessing Keycloak using:

https://rtmcdtm4x34.local:9444/auth

Then you need to use

hostname=https://rtmcdtm4x34.local:9444/auth

Or an http-relative-path of /auth - which will change the path for realms and resources as well.

Maribhuvan Jul 2, 2025
Author

@shawkins I have made the changes as you suggested but still not working as expected cookies are not set

Maribhuvan Jul 2, 2025
Author

Can u check my above code or else can you suggest working code on nodejs

shawkins Jul 2, 2025
Collaborator

I can help you resolve the basic issue of hostname / proxy configuration. You should be able to use hostname debug to confirm your new settings are correct: https://www.keycloak.org/server/hostname#_troubleshooting

From there if are not seeing insecure context warnings, then your issue lies elsewhere. We can then review your spi cookie settings, the proxy handling of cookies (for example #40111 (reply in thread)), and even the browser handling

Answer selected by Maribhuvan

Maribhuvan · 2025-07-03T12:37:23Z

Maribhuvan
Jul 3, 2025
Author

reverse proxy working as expected @shawkins Thank you for the help.

0 replies

Navigation Menu

Repository navigation

Reverse proxy setup cookie issue #40862

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments 5 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Reverse proxy setup cookie issue #40862

Uh oh!

Maribhuvan Jul 2, 2025

Before reporting an issue

Area

Describe the bug

Version

Regression

Expected behavior

Actual behavior

How to Reproduce?

Anything else?

Replies: 2 comments · 5 replies

Uh oh!

shawkins Jul 2, 2025 Collaborator

Uh oh!

shawkins Jul 2, 2025 Collaborator

Uh oh!

Maribhuvan Jul 2, 2025 Author

Uh oh!

Maribhuvan Jul 2, 2025 Author

Uh oh!

shawkins Jul 2, 2025 Collaborator

Uh oh!

Maribhuvan Jul 3, 2025 Author

Maribhuvan
Jul 2, 2025

Replies: 2 comments 5 replies

shawkins
Jul 2, 2025
Collaborator

shawkins Jul 2, 2025
Collaborator

Maribhuvan Jul 2, 2025
Author

Maribhuvan Jul 2, 2025
Author

shawkins Jul 2, 2025
Collaborator

Maribhuvan
Jul 3, 2025
Author