Search code examples
keycloak

KEYCLOAK_IDENTITY_LEGACY ? KEYCLOAK_SESSION_LEGACY?


Is there someone who is knowledgable on the Keycloak Session Cookies. I know the use for KEYCLOAK_IDENTITY and KEYCLOAK_SESSION , but in some cases I find the Session Cooies:

  • KEYCLOAK_IDENTITY_LEGACY
  • KEYCLOAK_SESSION_LEGACY.
  • AUTH_SESSION

I don't know why Keycloak is setting them. Maybe someone can help me?


Solution

  • The response may be quite delayed, but perhaps this is an open issue in keycloak can clarify why this was added in the first place.

    https://github.com/keycloak/keycloak/issues/16181

    In a nutshell, This was included to help older browsers that don't support the 'samesite=none' attribute, however as of this writing, there is an open discussion in which these cookies have no influence, and the issue I just gave you is for removing those cookies.