Keycloak Login Error: expired_code & Non-Secure Cookie Context

Issue Overview

When using Keycloak, you may encounter the following log warnings related to authentication errors and non-secure cookies:

Example Logs:

2025-01-27 01:51:15,045 WARN  [org.keycloak.cookie.DefaultCookieProvider] (executor-thread-3) Non-secure context detected; cookies are not secured, and will not be available in cross-origin POST requests
2025-01-27 01:51:15,049 WARN  [org.keycloak.events] (executor-thread-3) type="LOGIN_ERROR", realmId="9821b5e9-f662-4cc9-bc87-19019604c1a8", realmName="master", clientId="security-admin-console", userId="null", ipAddress="172.16.1.234", error="expired_code", restart_after_timeout="true"

Causes:

1. Expired Authentication Code:

   • The error expired_code suggests that the authentication code has expired. This can occur due to session timeouts, clock misalignment, or prolonged inactivity.

2. Non-Secure Cookie Context:

   • The warning Non-secure context detected; cookies are not secured indicates that Keycloak is not using secure cookies (i.e., cookies are not sent over HTTPS). This can affect cross-origin POST requests and the availability of cookies.

Solutions

1. Clear Cache:

• Browser Cache: Clear the cache in your browser to ensure there are no expired tokens still being used.
• Keycloak Cache: If the issue persists, clear the cache on the Keycloak server to remove any stale data.

2. Ensure Secure Cookies:

• Check and update your Keycloak configuration to ensure cookies are set as Secure (only sent over HTTPS) and HttpOnly (not accessible via JavaScript).
• This can be done by modifying the following in your Keycloak server configuration:
  • Set cookie.secure=true and cookie.httpOnly=true in the standalone.xml (or equivalent) file for your Keycloak installation.

3. Adjust Token Expiry or Session Timeout:

• Review the settings for token expiry in Keycloak. If the authentication codes are expiring too quickly, you can increase the lifespan of the access tokens and refresh tokens.
• Example of how to adjust token expiry settings:
  • Navigate to Realm Settings > Tokens in the Keycloak Admin Console and adjust the Access Token Lifespan and Refresh Token Lifespan.

4. Time Synchronization:

• Ensure that your Keycloak server and clients are synchronized with a reliable time source to avoid discrepancies in token expiry times.

5. Restart Keycloak:

• After making the changes, restart the Keycloak server to ensure the new configurations are applied.

Additional Notes

• If you continue to encounter this issue after performing the above steps, consider reviewing your Keycloak session settings or network configurations.
• Make sure that any reverse proxies (e.g., Nginx, Apache) or load balancers are correctly handling HTTPS and forwarding secure cookies.

Example Keycloak Configuration Adjustments:

Secure Cookies:

To enforce secure cookies in Keycloak, update the configuration as follows:

• In the standalone.xml (or equivalent) file, add or modify the setting:

<security-constraints>
    <cookie>
        <secure>true</secure>
        <http-only>true</http-only>
    </cookie>
</security-constraints>

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------

Written by A.M. Rinas