Repository navigation
Unable to load console when KC_HOSTNAME and KC_HOSTNAME_ADMIN are set at different URL's. Set-Cookie header didn't specify "SameSite" Attribute #41411
|
Hello, Looking for some assistance - i am trying to deploy keycloak and have the admin console available in our internal domain and not exposed to the external domain. Our domains are like so I have the following relevant settings And the relevant dockerfile build command
When i try to browse to https://internal.com/auth/admin/master/console/ I start to get a loading screen and it fails after hitting "step1.html" and then "my.policy" in the requests. (Both of these requests go to my https://external.com domain, specifically https://external.com/realms/master/protocol/openid-connect/3p-cookies/step1.html" These requests fail with the following warnings in dev tools "This set-cookie header didn't specify a "SameSite" attribute and was defaulted to "SameSite=Lax", and was blocked because it came from a cross-site response which not the response to a top-level navigation. The Set-Cookie had to have been set with "SameSite=None" to enable cross-site usage" Additional InformationBehind an AWS ALB Load Balancer |
Replies: 3 comments 1 reply
|
Further troubleshooting, tried setting To see if console works at external URL and i still get met with the same screen "Something went wrong, sorry an unexpected error has occurred" But the cookie errors go away, and i receive 200 OK from Step1.html |
|
Okay the external URL is working after setting However back to original issue after doing this. |
|
@Eric-Domeier to confirm, you want: KC_HOSTNAME=https://external.com/auth Based upon your other settings you seem to be running an edge proxy which is setting xforwarded headers, correct?
It would be worth verifying what the proxy is doing in this case - it could be manipulating the cookies as well. If you are able, it would be worth hitting the keycloak instance directly, not via the proxy, but with the appropriat headers set just so you can see what the actua 8000 l reponse to the proxy looks like. |
|
@shawkins Thanks for the reply. I believe you're correct. we are behind another organizations boundary, they appear to have a CSP policy causing the issue it seems. Will mark this as the likely answer as I wait for a ticket to hopefully fix. thanks! |
@Eric-Domeier to confirm, you want:
KC_HOSTNAME=https://external.com/auth
KC_HOSTNAME_ADMIN=https://internal.com/auth
Based upon your other settings you seem to be running an edge proxy which is setting xforwarded headers, correct?
It would be worth verifying what the proxy is doing in this case - it could be manipulating the cookies as well. If you are able, it would be worth hitting the keycloak instance directly, not via the proxy, but with the appropriat headers set just so you can see what the actual reponse to the proxy looks like.