Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Content-Security-Policy issue with KC_HOSTNAME_ADMIN option set

See original GitHub issue

Describe the bug

With Keycloak 17.0.0 when trying to access Keycloak admin console through the hostname set in KC_HOSTNAME_ADMIN I hit the following error in the browser console:

Refused to frame 'https://console.idp.test.local/realms/master/protocol/openid-connect/3p-cookies/step1.html' because it violates the following Content Security Policy directive: "frame-src https://idp.test.local".

Keycloak is running inside a container that has the following env vars set:

KC_HOSTNAME: idp.test.local KC_HOSTNAME_ADMIN: console.idp.test.local KC_HOSTNAME_STRICT_BACKCHANNEL: “true”

Keycloak starts with the following hostname log:

2022-02-20 17:53:18,279 INFO [org.keycloak.quarkus.runtime.hostname.DefaultHostnameProvider] (main) Hostname settings: FrontEnd: idp.test.local, Strict HTTPS: false, Path: <request>, Strict BackChannel: true, Admin: console.idp.test.local

Version

17.0.0

Expected behavior

Display the login screen without errors

Actual behavior

Throws an error in the browser console and displays an error popup

How to Reproduce?

No response

Anything else?

No response

Issue Analytics

State:
Created 2 years ago
Reactions:8
Comments:6 (1 by maintainers)

Top GitHub Comments

6reactions

jesse-savarycommented, Jun 17, 2022

Still encountering this on 18.0.1

2reactions

hellobiekcommented, Jun 19, 2022

Is there any resolution?

Top Results From Across the Web

The option KC_HOSTNAME_ADMIN does not work

I want to set up access to the admin console only from a private interface ... can't check sso status because it is...

How to have Keycloak login page in iframe? - Stack Overflow

I tried the following setting in the Keycloak Real Settings > Security Defenses > Headers > Content-Security-Policy

[keycloak quarkus 18.0.0] running against db: empty page

I try to run against a db (mariadb) in OpenShift 4.10 / Kubernetes 1.23 start page works. when click "Administration Console" (/admin/master/console/) I...

Server Administration Guide - Keycloak

A realm manages a set of users, credentials, roles, and groups. A user belongs to and logs into a realm. Realms are isolated...

Adding hosts to your Content-Security-Policy (CSP) for Userlane

If you are using CSP to protect your application, you need to add some policies to make sure Userlane can work correctly. Using...