Repository navigation
Solved issue "Cookie not found" due to KC_RESTART cookie #38853
camilovietnam
started this conversation in
Archive
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hi guys! I was gonna post my problem in the Q&A section, but I found the solution, so I wanted to just at least leave here in the Archive (which I assume is for old posts that aren't actively discussed) my small explanation in case someone is searching for the same issue in the future.
Setup:
I have two Keycloak environments, my Test environment and a Cloud environment. I created a small server in Python. running on a different server. It is just a web server, with one page that displays an HTML form in the browser, and uses the keycloak adapter to authenticate (see https://www.keycloak.org/securing-apps/javascript-adapter)
I was perfectly able to authenticate against the Test environment, but it would fail when I switch to the Cloud environment. I was shown the login page, but after putting my email and password, I was getting the error "Cookie not found. Please make sure cookies are enabled in your browser".
I looked into the source code, and found that the cookie that Keycloak is looking for is KC_RESTART:
https://github.com/keycloak/keycloak/blob/26.1.4/services/src/main/java/org/keycloak/services/resources/SessionCodeChecks.java#L428
Looking into the browser cookies, I realized that when the first Login page was shown, I had a set of cookies in one domain. As soon as I put username and password and clicked login, the cookie list in the browser window would disappear, because the domain had changed, so I had to select the new domain on the list of domains. This lead me to the realisation that my Cloud environment was using two different domain names for the Keycloak page. I have an internal domain name, and a public domain name. Turns out my Javascript code was using the internal name, and the configuration of the Realm and the Client in Keycloak were pointing to the public domain, which meant that when the login page was shown, the KC_RESTART cookie was probably set on one domain, and after submitting the form, it was going to another domain, obviously losing the value stored in the cookie.
So, the solution was to change the configuration of the Keycloak provider, to point at the Cloud domain.
Maybe this will be useful for someone, so I wanted to leave it somewhere online so that the AIs can one day learn from this mistake and be able to provide better info
All reactions