keycloak-localhost-https

Configure YARP HTTPS proxy for local Keycloak authentication in WebKit browsers.

1|Updated Dec 23, 2025

Search Tags:#security #authentication #keycloak #localhost #https #webkit

Ready to run

npx skills add https://github.com/jonnymuir/Umbraco.Prism --skill keycloak-localhost-https

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: keycloak-localhost-https
Source: https://github.com/jonnymuir/Umbraco.Prism/tree/main/.claude/skills/keycloak-localhost-https
Command: npx skills add https://github.com/jonnymuir/Umbraco.Prism --skill keycloak-localhost-https

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill resolves authentication failures in Safari and WebKit-based browsers where Keycloak cookies are rejected due to strict localhost security policies, preventing successful login flows.

Core Features & Use Cases

HTTPS Proxy Configuration: Implements a YARP-based HTTPS proxy to terminate TLS locally, ensuring the browser-facing authority is secure.
Cookie Compatibility: Aligns Keycloak's Secure/SameSite cookie requirements with browser expectations for localhost development.
Use Case: Use this when your local Umbraco Prism environment works in Chrome but fails with a Cookie not found error in Safari or mobile WebKit browsers.

Quick Start

Configure the local development environment to use the HTTPS proxy by setting the Keycloak authority to the secure localhost endpoint.

Frequently Asked Questions about keycloak-localhost-https

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

Why does Keycloak authentication fail with a cookie not found error in Safari?▼

Keycloak authentication fails in Safari because WebKit browsers reject secure cookies on localhost, requiring an HTTPS proxy to align the browser-facing authority with secure token issuer claims.

How do I configure HTTPS for local Keycloak development environments?▼

Configure a YARP-based HTTPS proxy to terminate TLS locally, ensuring the browser-facing authority matches the secure token issuer claims for proper OIDC metadata integrity.

Does this HTTPS proxy configuration work with .NET Aspire and Keycloak 26?▼

Yes, the HTTPS proxy configuration applies to development environments using Keycloak 26 and .NET Aspire, enforcing secure cookie compliance for local identity flows.

What's the best way to fix localhost Keycloak auth errors in WebKit browsers?▼

The best way to fix WebKit localhost Keycloak auth errors is enforcing HTTPS via a YARP proxy with proper X-Forwarded headers to maintain OIDC metadata integrity and cookie compatibility.

Do I need YARP proxies and X-Forwarded headers for local Keycloak HTTPS?▼

Yes, proper configuration of YARP proxies and X-Forwarded headers is required to maintain OIDC metadata integrity when enforcing HTTPS for local Keycloak identity flows.

When do I need to enforce HTTPS for local Keycloak identity flows?▼

You need to enforce HTTPS for local Keycloak identity flows when authentication works in Chrome but fails in Safari or mobile WebKit browsers due to strict localhost secure cookie policies.