Repository navigation
How to configure SameSite=Strict and HttpOnly=true for Keycloak session cookies in Keycloak 26.3.0? #44434
Unanswered
AakankshaGhodake
asked this question in
Q&A
How to configure SameSite=Strict and HttpOnly=true for Keycloak session cookies in Keycloak 26.3.0?
#44434
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Description
I am using Keycloak 26.3.0 and I want to configure the session cookies (such as KEYCLOAK_SESSION, KEYCLOAK_IDENTITY, and AUTH_SESSION_ID) to include these attributes:
SameSite=Strict
HttpOnly=true
I have checked the Keycloak documentation but I could not find a clear way to set these attributes for Keycloak’s session cookies.
What I tried:
Editing the keycloak.conf file to see if there are any cookie-related options
Searching through Keycloak docs and community posts for any official settings
However, I still cannot find any supported configuration for forcing SameSite=Strict or modifying the cookie attributes for session cookies.
Request:
Could the maintainers please clarify:
Is there an official way to configure SameSite attributes (especially SameSite=Strict) for Keycloak session cookies in Keycloak 26.3.0?
Are these cookie attributes configurable through keycloak.conf, CLI options, or any supported configuration?
If not supported, is there a recommended workaround?
Thank you.
All reactions