# Keycloak iframe re-authenticate/You are already logged in **URL:** \ **Category:** Configuring the server\ **Tags:** authentication\ **Created:** [October 24, 2024, 9:14am UTC](https://forum.keycloak.org/t/keycloak-iframe-re-authenticate-you-are-already-logged-in/28456 "2024-10-24T09:14:41Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![lotfio](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/lotfio/32/11498_2.png) [@lotfio](https://forum.keycloak.org/u/lotfio)\ **Post date:** [October 24, 2024, 9:14am UTC](https://forum.keycloak.org/t/keycloak-iframe-re-authenticate-you-are-already-logged-in/28456/1 "2024-10-24T09:14:41Z")
I am embedding keycloak on an iframe to allow users to change their passwords and enable 2FA Users are already logged in to the main site however when they browse the iframe they get asked to re-authenticate ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/c/c1958458efd4e18b723bf730d12e4c573b39d75a.png) Once they re-authenticate they get an error message Already logged in [[Album] imgur.com ![](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/7/72462e04ee91d3e8d56c44c4fa529948daa3ba42.png "imgur.com") ](https://imgur.com/a/CHGcsfE) I am not sure if it is related to a cookie conflict or some server configuration ? ---
**Author:** ![ben.overcash](https://avatars.discourse-cdn.com/v4/letter/b/d9b06d/32.png) [@ben.overcash](https://forum.keycloak.org/u/ben.overcash)\ **Post date:** [October 24, 2024, 5:51pm UTC](https://forum.keycloak.org/t/keycloak-iframe-re-authenticate-you-are-already-logged-in/28456/2 "2024-10-24T17:51:16Z")
Open the browser’s developer tools and check the `KC_SESSION` cookie while re-authenticating. To work as expected it should be marked as `SameSite: None` and `Secure`. If it’s not then the browser is probably blocking it inside the iframe. What version of Keycloak are you running? I just updated to version 26 and I had to do some custom cookie stuff to get this working when running inside Kubernetes. ---
**Author:** ![lotfio](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/lotfio/32/11498_2.png) [@lotfio](https://forum.keycloak.org/u/lotfio)\ **Post date:** [October 24, 2024, 9:34pm UTC](https://forum.keycloak.org/t/keycloak-iframe-re-authenticate-you-are-already-logged-in/28456/3 "2024-10-24T21:34:36Z")
We are using Version 20 of keycloack and here is a picture of the cookies i see ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/f/ff2c8bb45fe43a9a1b2e0a3d4fc5388c405746cf.png) When I hover over the Cookies/Domain in left side i get this message “iframe cookies may have been blocked due to third party phaseout” ---
**Author:** ![ben.overcash](https://avatars.discourse-cdn.com/v4/letter/b/d9b06d/32.png) [@ben.overcash](https://forum.keycloak.org/u/ben.overcash)\ **Post date:** [October 25, 2024, 3:04am UTC](https://forum.keycloak.org/t/keycloak-iframe-re-authenticate-you-are-already-logged-in/28456/4 "2024-10-25T03:04:25Z")
Yep, if your browser assumes `Lax` for the `KC_SESSION` cookie it will be ignored when doing crossorigin requests (like with iframes). For Keycloak 20 here’s the code in play [keycloak/services/src/main/java/org/keycloak/protocol/RestartLoginCookie.java at archive/release/20.0 · keycloak/keycloak · GitHub](https://github.com/keycloak/keycloak/blob/archive/release/20.0/services/src/main/java/org/keycloak/protocol/RestartLoginCookie.java) There doesn’t appear to be any way to set a SameSite value, this code always passes in `null`. I think you’d need to either update Keycloak or introduce a proxy layer to modify the request headers. ---
**Author:** ![embesozzi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/embesozzi/32/12390_2.png) [@embesozzi](https://forum.keycloak.org/u/embesozzi)\ **Post date:** [October 25, 2024, 12:45pm UTC](https://forum.keycloak.org/t/keycloak-iframe-re-authenticate-you-are-already-logged-in/28456/5 "2024-10-25T12:45:01Z")
An easier solution is to avoid using iframes. In the past (long ago), they were an option, but nowadays, they cause headaches for many reasons. Instead, use the traditional redirect. ---
**Author:** ![ben.overcash](https://avatars.discourse-cdn.com/v4/letter/b/d9b06d/32.png) [@ben.overcash](https://forum.keycloak.org/u/ben.overcash)\ **Post date:** [October 25, 2024, 2:15pm UTC](https://forum.keycloak.org/t/keycloak-iframe-re-authenticate-you-are-already-logged-in/28456/6 "2024-10-25T14:15:34Z")
Absolutely. We are actively fighting the iframe fight and it feels like a losing battle. “We do this not because it is easy, but because we thought it would be easy” ---
**Author:** ![embesozzi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/embesozzi/32/12390_2.png) [@embesozzi](https://forum.keycloak.org/u/embesozzi)\ **Post date:** [October 25, 2024, 2:34pm UTC](https://forum.keycloak.org/t/keycloak-iframe-re-authenticate-you-are-already-logged-in/28456/7 "2024-10-25T14:34:21Z")
The problem is that you’re fighting a battle where you don’t set the rules, and they keep changing over time (SameSite cookie restrictions, third-party cookie changes, etc). As a result, there’s a high chance you’ll end up losing it 😐 ---
**Author:** ![lotfio](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/lotfio/32/11498_2.png) [@lotfio](https://forum.keycloak.org/u/lotfio)\ **Post date:** [October 27, 2024, 8:09pm UTC](https://forum.keycloak.org/t/keycloak-iframe-re-authenticate-you-are-already-logged-in/28456/8 "2024-10-27T20:09:42Z")
I will try to upgrade keycloack as ben suggested as we have several platforms using iframe. if the issue persists I will switch all systems to traditional redirects. I will keep you posted Thank you very much.