Repository navigation
Clarification on KC_AUTH_SESSION_HASH Cookie and Feasibility of Enabling HttpOnly #40885
Unanswered
renatoeufe
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hi,
We recently conducted a penetration test on our application using Keycloak (version 26.2), and it flagged the KC_AUTH_SESSION_HASH cookie as lacking the HttpOnly flag, posing a medium-risk vulnerability due to potential XSS attacks.
Based on our analysis, this cookie appears to be used for federated identity session management, requiring JavaScript access (scope FEDERATION_JS, HttpOnly=false) for features like OIDC session management or silent check-sso.
Our understanding is that enabling the HttpOnly flag on KC_AUTH_SESSION_HASH could break critical functionalities, such as session status iframes or federated SSO flows, due to its design.
We also noted that direct configuration of cookie attributes is limited in Keycloak, and using a reverse proxy to force HttpOnly might disrupt these features. As a result, we’re considering mitigating the risk with a strong Content-Security-Policy (CSP) and other headers instead.
Could you confirm the following:
Thank you for your insights!
All reactions