# Keycloak docker deployment no login possible

**URL:** <https://forum.keycloak.org/t/keycloak-docker-deployment-no-login-possible/7275>\
**Category:** Miscellanaeous\
**Created:** [February 9, 2021, 12:00pm UTC](https://forum.keycloak.org/t/keycloak-docker-deployment-no-login-possible/7275 "2021-02-09T12:00:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rpolito](https://avatars.discourse-cdn.com/v4/letter/r/e9c0ed/32.png) [@rpolito](https://forum.keycloak.org/u/rpolito)\
**Post date:** [February 9, 2021, 12:00pm UTC](https://forum.keycloak.org/t/keycloak-docker-deployment-no-login-possible/7275/1 "2021-02-09T12:00:25Z")

</div>

When i try to log in to my keycloak (in a docker container) i get followed message:

```auto
Refused to frame 'http://keycloak:8080/' because it violates the following Content Security Policy directive: "frame-src 'self'".

```

nginx conf:

```auto
server {
		listen 80;
		listen [::]:80;
		server_name keycloak.fs-theorie.de;
		
		sub_filter 'http://keycloak:8080' 'http://keycloak.fs-theorie.de';
		sub_filter_once off;

		location / {
			proxy_pass http://keycloak:8080;
		}
	}

```

---

<div class="post-metadata">

**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\
**Post date:** [February 9, 2021, 2:31pm UTC](https://forum.keycloak.org/t/keycloak-docker-deployment-no-login-possible/7275/2 "2021-02-09T14:31:05Z")

</div>

It looks like you have wrong deployment design, when you need `sub_filter`:

1.) Keycloak container needs `PROXY_ADDRESS_FORWARDING=true`  
Doc: [Docker Hub](https://hub.docker.com/r/jboss/keycloak/)

AND

2.) Nginx must have configured headers properly, so Keycloak will know where to redirect properly (so you don’t need subfilter hacking)

```auto
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Server $host;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_set_header X-Forwarded-Proto $scheme;

```

Doc: [Server Installation and Configuration Guide](https://www.keycloak.org/docs/latest/server_installation/index.html#_setting-up-a-load-balancer-or-proxy)

You can get inspiration from GitHub: e.g. [GitHub - jinnerbichler/keycloak-nginx: Example for using NGINX as reverse proxy for Keycloak.](https://github.com/jinnerbichler/keycloak-nginx) but read Keycloak documentation - examples may not working properly with current Keycloak version.

Also remember that OIDC requires https in prod - then [Keycloak Docker HTTPS required - Stack Overflow](https://stackoverflow.com/questions/49859066/keycloak-docker-https-required/49874353#49874353) may be helpful for you.