Can we set HttpOnly flag to KEYCLOAK_SESSION cookie?

user_14314266 0
Viewed 2796

Why does the KEYCLOAK_SESSION cookie in Keycloak does not have HttpOnly flag set in first place as against other cookies?

keycloak
1 Answers

As @besverino mentions in his comment, KeyCloak doesn't allow set KEYCLOAK_SESSION HttpOnly flag because KeyCloak needs to access the cookie from iFrame. Comment on this part of KeyCloak code is:

THIS SHOULD NOT BE A HTTPONLY COOKIE! It is used for OpenID Connect Iframe Session support!

References:

  1. https://github.com/keycloak/keycloak/blob/16.1.1/services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java#L751
  2. https://lists.jboss.org/pipermail/keycloak-user/2017-September/011882.html
user_65840210
Related