Repository navigation
Conversation
a91b916 to
d71408e
Compare
There was a problem hiding this comment.
@jonkoops Thanks! I don't see any issues with removing the legacy Keycloak Session cookie.
@mposolda @stianst @pedroigor Could you please take a look at it?
There was a problem hiding this comment.
Does it make sense to include a switch to enable legacy cookies for backward compatibility and evaluation of the impact on the existing deployments?
We can use a hidden option in our config or just use a system property. I think how we set this is not so relevant as we want to effectively remove those cookies.
The idea is to at least give a chance to people to plan the upgrade if they need to support old browsers.
|
+1 for making it switchable. Instead of using a hidden config option, could we add it to the |
|
I see no issue with putting this behind a flag, and I agree with @ahus1 that the default should be disabled. Let me see what I can do. |
|
Created a new PR under #16747 as I'd like to keep this one to eventually remove the feature. |
_LEGACY)|
There's a related aspect: it seems the legacy cookies don't have the "secure" attribute set which poses a security problem. |
|
Closing this PR as we decided to put this behind a profile first. I'll get back to this once that lands. |
Closes #16770