Repository navigation
Deal with encrypted session
#38901
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hi,
First, I want to thank everyone working on this project for their efforts.
I’m using
@fastify/passport,@fastify/secure-session, andopenid-clientin my application. When users log in via Keycloak, the tokens returned (e.g.,id_token) are encrypted usingsecure-sessionand stored as cookies in the user's browser.The issue arises when I redirect users from my application to Keycloak's Account Management Console to update their profile or verify their email. Since the tokens are encrypted in the session, Keycloak cannot access the
id_tokento identify the user, and the user is prompted to log in again.Is there a way to securely share the encryption secret used by
secure-sessionwith Keycloak so that it can decrypt the tokens and allow the user to proceed without logging in again? Or is there another recommended approach to handle this scenario?Thank you!
All reactions