Bug: Keycloak logs "Non-secure context detected" — cookies not secured behind Tailscale TLS #276

New issue

Open

opened 2026-04-08 21:32:32 +00:00 by forgejo_admin · 0 comments

forgejo_admin commented

2026-04-08 21:32:32 +00:00

Contributor

Type

Bug

Lineage

Discovered during Keycloak SMTP validation on 2026-04-08. Observed in pod logs.

Repo

forgejo_admin/pal-e-platform

What Broke

Keycloak logs: Non-secure context detected; cookies are not secured, and will not be available in cross-origin POST requests. This means Keycloak thinks it's running on HTTP, not HTTPS. Tailscale funnel terminates TLS before the request reaches the pod, so Keycloak sees plain HTTP internally.

This can cause:

Cookies not being set with Secure flag
Cross-origin POST requests failing (affects OAuth flows)
Auth issues in some browsers

Repro Steps

Check Keycloak pod logs: kubectl logs -n keycloak keycloak-7d796fc76c-prqxh
Observe: Non-secure context detected; cookies are not secured

Expected Behavior

Keycloak should be configured to trust the proxy (Tailscale funnel) and treat requests as HTTPS.

Environment

Cluster/namespace: prod / keycloak
Keycloak pod: keycloak-7d796fc76c-prqxh

Acceptance Criteria

Keycloak configured with KC_PROXY_HEADERS=xforwarded or KC_PROXY=edge env var
Warning no longer appears in logs
Cookies are set with Secure flag

File Targets

terraform/modules/keycloak/main.tf — add proxy env var to Keycloak Helm values

pal-e-platform — Keycloak infrastructure
May explain intermittent auth issues if any have been reported

### Type Bug ### Lineage Discovered during Keycloak SMTP validation on 2026-04-08. Observed in pod logs. ### Repo `forgejo_admin/pal-e-platform` ### What Broke Keycloak logs: `Non-secure context detected; cookies are not secured, and will not be available in cross-origin POST requests`. This means Keycloak thinks it's running on HTTP, not HTTPS. Tailscale funnel terminates TLS before the request reaches the pod, so Keycloak sees plain HTTP internally. This can cause: - Cookies not being set with `Secure` flag - Cross-origin POST requests failing (affects OAuth flows) - Auth issues in some browsers ### Repro Steps 1. Check Keycloak pod logs: `kubectl logs -n keycloak keycloak-7d796fc76c-prqxh` 2. Observe: `Non-secure context detected; cookies are not secured` ### Expected Behavior Keycloak should be configured to trust the proxy (Tailscale funnel) and treat requests as HTTPS. ### Environment - Cluster/namespace: prod / keycloak - Keycloak pod: `keycloak-7d796fc76c-prqxh` ### Acceptance Criteria - [ ] Keycloak configured with `KC_PROXY_HEADERS=xforwarded` or `KC_PROXY=edge` env var - [ ] Warning no longer appears in logs - [ ] Cookies are set with `Secure` flag ### File Targets - `terraform/modules/keycloak/main.tf` — add proxy env var to Keycloak Helm values ### Related - `pal-e-platform` — Keycloak infrastructure - May explain intermittent auth issues if any have been reported