9:47 p.m.
Hi Bill,
thanks for the info on "require SSL" in the realm Login settings. I did not
toggle that because I thought that it will require Java keystore
certificates whereas I am just fronting with NGINX. Oh well, I tested and
it works.
Also thanks for clarifying the HttpOnly behaviour.
Regards,
Rudy.
On Fri, Sep 22, 2017 at 8:40 PM, Bill Burke <bburke(a)redhat.com> wrote:
The realm's SSL policy has to be set to SSL required for
Secure-Only
to be set. Out of the box, Keycloak does not have SSL/HTTPS set up.
Wildfly recently introduced an SSL setup option that we may eventually
take advantage of, but right now, Keycloak does not have SSL/HTTP
enabled out of the box.
Looking at our code KEYCLOAK_SESSION cookie is not marked HttpOnly and
is used by our iframe to detect if the user is logged in still.
KEYCLOAK_IDENTITY *is* marked HttpOnly.
On Wed, Sep 20, 2017 at 7:31 AM, Rudresh Shashikant <rudreshsj(a)gmail.com>
wrote:
> Hi
>
> I would like to discuss 2 items when Keycloak responds with "Set-Cookie"
> headers:
> 1. "HttpOnly" flag
> 2. "Secure" flag
>
> 1. "HttpOnly" flag:
> I can see that affected cookie is:
> * KEYCLOAK_SESSION
>
> My understanding is (please correct me where inaccurate/wrong) that the
> "HttpOnly" flag is not included on purpose because the iframe in the
> browser that maintains the session with keycloak needs Javascript to
modify
> the cookie and hence the "HttpOnly" flag will disallow this ability,
> breaking the feature as a result.
>
> Reference: The OIDC spec (
> http://openid.net/specs/openid-connect-session-1_0.html) states that :
> *"If a cookie is used to maintain the OP browser state, the HttpOnly flag
> likely can't be set for this cookie because it needs to be accessed from
> JavaScript. Therefore, information that can be used for identifying the
> user should not be put into the cookie, as it could be read by unrelated
> JavaScript."*
>
> 2. "Secure" flag:
> I can see that affected cookies are:
> * AUTH_SESSION_ID
> * KC_RESTART
> * KEYCLOAK_IDENTITY
> * KEYCLOAK_SESSION
>
> I fail to understand why the "Secure" flag is not being set on all these
> cookies. As I understand it, "Secure" flag should be set to ensure that
> only the "HTTPS" version of the site can access the cookie else a
"HTTP"
> version will also be able to access the cookie on the same domain.
>
> The NGINX proxy will have a 301 redirect for all HTTP requests so it is
not
> a major concern but it still does not answer the question as to why the
> server did not set this flag on all cookies.
> Can it be set using NGINX ? If it is set will any keycloak feature break?
>
> Thanks.
>
> Regards,
> Rudy.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
--
Bill Burke
Red Hat