title: Keycloak: Session cookies are missing within the token request with the new Chrome SameSite/Secure cookie enforcement
body: <p>Recently my application using Keycloak stopped working with a 400 token request after authenticating.</p>
  
  <p>What I found so far is that within the token request, the Keycloak cookies (AUTH_SESSION_ID, KEYCLOAK_IDENTITY, KEYCLOAK_SESSION) are not sent within the request headers causing the request for a token to fail and the application gets a session error.</p>
  
  <p>By digging more, I found that Chrome blocks now cookies without SameSite attribute set, which is the case for the keycloak cookies and that's why they are never parsed within the token acquisition request after authenticating.</p>
  
  <p>The error I get:- </p>
  
  <p><a href="https://i.stack.imgur.com/YijeI.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/YijeI.jpg" alt="enter image description here"></a>
  <a href="https://blog.chromium.org/2019/10/developers-get-ready-for-new.html" rel="noreferrer">https://blog.chromium.org/2019/10/developers-get-ready-for-new.html</a></p>
  
  <p><a href="https://adzerk.com/blog/chrome-samesite/" rel="noreferrer">https://adzerk.com/blog/chrome-samesite/</a></p>
  
  <p><strong>This is very serious as it blocks applications secured by Keycloak library  to be able to communicate with the keycloak server.</strong></p>
  
  <p><strong>Update</strong>: With the new google chrome cookie SameSite attribute, any third party library using cookies without SameSite attribute properly set, the cookie will be ignored.
  <a href="https://blog.chromium.org/2019/10/developers-get-ready-for-new.html" rel="noreferrer">https://blog.chromium.org/2019/10/developers-get-ready-for-new.html</a></p>
  
  <p><a href="https://www.chromium.org/updates/same-site" rel="noreferrer">https://www.chromium.org/updates/same-site</a></p>