# Keycloak is adding adding port 80 to https urls

**URL:** <https://forum.keycloak.org/t/keycloak-is-adding-adding-port-80-to-https-urls/11808>\
**Category:** Configuring the server\
**Created:** [October 30, 2021, 8:45am UTC](https://forum.keycloak.org/t/keycloak-is-adding-adding-port-80-to-https-urls/11808 "2021-10-30T08:45:35Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![giogio](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/giogio/32/4268_2.png) [@giogio](https://forum.keycloak.org/u/giogio)\
**Post date:** [October 30, 2021, 8:45am UTC](https://forum.keycloak.org/t/keycloak-is-adding-adding-port-80-to-https-urls/11808/1 "2021-10-30T08:45:35Z")

</div>

Hi,

I have deployed an instance of keycloack (with this chart [keycloak 15.1.0 · codecentric/codecentric](https://artifacthub.io/packages/helm/codecentric/keycloak)) in my kubernetes cluster, and it is running behind a reverse-proxy kubernetes ingress.

If I send a request to `https://{host}/auth/realms/master/.well-known/openid-configuration` to check the config, it’s almost ok, except that all the urls have an added port 80

e.g.  
issuer: “https://{host}:80/auth/realms/master”

How can I remove this port?

---

<div class="post-metadata">

**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\
**Post date:** [October 30, 2021, 1:21pm UTC](https://forum.keycloak.org/t/keycloak-is-adding-adding-port-80-to-https-urls/11808/2 "2021-10-30T13:21:27Z")

</div>

Did you follow readme [keycloak 15.1.0 · codecentric/codecentric](https://artifacthub.io/packages/helm/codecentric/keycloak#running-keycloak-behind-a-reverse-proxy) ?

---

<div class="post-metadata">

**Author:** ![giogio](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/giogio/32/4268_2.png) [@giogio](https://forum.keycloak.org/u/giogio)\
**Post date:** [October 30, 2021, 2:37pm UTC](https://forum.keycloak.org/t/keycloak-is-adding-adding-port-80-to-https-urls/11808/3 "2021-10-30T14:37:21Z")

</div>

Yes  
I already set `PROXY_ADDRESS_FORWARDING` to `true`, otherwise it would set the urls protocol to http (although it would remove the port)

---

<div class="post-metadata">

**Author:** ![RbBrDkie](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rbbrdkie/32/6246_2.png) [@RbBrDkie](https://forum.keycloak.org/u/RbBrDkie)\
**Post date:** [July 28, 2022, 8:57am UTC](https://forum.keycloak.org/t/keycloak-is-adding-adding-port-80-to-https-urls/11808/4 "2022-07-28T08:57:02Z")

</div>

I have the same problem, doesn’t matter what I do I can’t find anything that will change the port to anything else, seems the problem is if keycloak doesn’t do https termination itself it forces port 80? something like that.

```auto
    nginx.ingress.kubernetes.io/configuration-snippet: |
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto: https;
      # proxy_set_header X-Forwarded-Host $host;

image: quay.io/keycloak/keycloak:18.0.2
args: ["start-dev","--hostname-strict-https=false"]
        - name: KEYCLOAK_ADMIN
          value: "admin"
        - name: KEYCLOAK_ADMIN_PASSWORD
          value: "admin"
        - name: KC_PROXY
          value: "edge"
        - name: PROXY_ADDRESS_FORWARDING
          value: "true"

```

---

<div class="post-metadata">

**Author:** ![nikel123](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nikel123/32/5145_2.png) [@nikel123](https://forum.keycloak.org/u/nikel123)\
**Post date:** [August 3, 2022, 11:44am UTC](https://forum.keycloak.org/t/keycloak-is-adding-adding-port-80-to-https-urls/11808/5 "2022-08-03T11:44:54Z")

</div>

You have to set approptiate KC\_HOSTNAME for the keycloak to know your external hostname to redirect to. Also set KC\_PROXY to edge. This is how it works for me

---

<div class="post-metadata">

**Author:** ![neilr32e](https://avatars.discourse-cdn.com/v4/letter/n/35a633/32.png) [@neilr32e](https://forum.keycloak.org/u/neilr32e)\
**Post date:** [August 12, 2022, 9:26pm UTC](https://forum.keycloak.org/t/keycloak-is-adding-adding-port-80-to-https-urls/11808/6 "2022-08-12T21:26:26Z")

</div>

@RbBrDkie did you ever figure this out? I’m at the exact same spot with it forcing port 80 no matter what I do.

---

<div class="post-metadata">

**Author:** ![weltonrodrigo](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/weltonrodrigo/32/3104_2.png) [@weltonrodrigo](https://forum.keycloak.org/u/weltonrodrigo)\
**Post date:** [August 13, 2022, 12:29pm UTC](https://forum.keycloak.org/t/keycloak-is-adding-adding-port-80-to-https-urls/11808/7 "2022-08-13T12:29:57Z")

</div>

You seem to be using Kubernetes. The nginx ingress controller will set `X-Forwarded-Host`, `X-Forwarded-Proto` and `X-Forwarded-Port` so keycloak knows it behind a reverse proxy and can build the external url for the openid connect endpoints.

Problem is: if you have another reverse proxy in front of your nginx ingress controller, out of the box nginx will rewrite those headers sent by the first proxy and the information is lost.

If thats the case for you (a reverse proxy in front of your kubernetes ingress) you’ll need to [configure nginx ingress to trust those headers](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#use-forwarded-headers).

CAREFUL: that configuration should only be activated if you really have another proxy in front of your nginx ingress. If not, nginx will trust those headers and a malicious user can set them.

---

<div class="post-metadata">

**Author:** ![RbBrDkie](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rbbrdkie/32/6246_2.png) [@RbBrDkie](https://forum.keycloak.org/u/RbBrDkie)\
**Post date:** [August 15, 2022, 8:13am UTC](https://forum.keycloak.org/t/keycloak-is-adding-adding-port-80-to-https-urls/11808/8 "2022-08-15T08:13:37Z")

</div>

I’m still stuck, I changed my config as follows:  
ingress-nginx configmap:

```auto
data:
  use-forwarded-headers: “true”

```

ingress:

```auto
    nginx.ingress.kubernetes.io/configuration-snippet: |
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto: https;
      # proxy_set_header X-Forwarded-Host $host;

```

And envs

```auto
        - name: KEYCLOAK_ADMIN
          value: admin
        - name: KEYCLOAK_ADMIN_PASSWORD
          value: s ****** y
        - name: KC_PROXY
          value: edge
        - name: KC_HOSTNAME
          value: keycloak. ********.com
        - name: KEYCLOAK_LOGLEVEL
          value: DEBUG
        - name: PROXY_ADDRESS_FORWARDING
          value: "true"

```

---

<div class="post-metadata">

**Author:** ![weltonrodrigo](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/weltonrodrigo/32/3104_2.png) [@weltonrodrigo](https://forum.keycloak.org/u/weltonrodrigo)\
**Post date:** [August 15, 2022, 1:39pm UTC](https://forum.keycloak.org/t/keycloak-is-adding-adding-port-80-to-https-urls/11808/9 "2022-08-15T13:39:58Z")

</div>

You don’t need the `nginx.ingress.kubernetes.io/configuration-snippet` because nginx already set those headers.

I may suggest you to use a debug pod like `daime/http-dump:latest` instead of keycloak to see if the headers are correct. http-dump will dump the request it received from the nginx controller so you can inspect it.

Check if all `X-Forwarded-XXXX` headers are correctly set.

---

<div class="post-metadata">

**Author:** ![RbBrDkie](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rbbrdkie/32/6246_2.png) [@RbBrDkie](https://forum.keycloak.org/u/RbBrDkie)\
**Post date:** [August 15, 2022, 2:14pm UTC](https://forum.keycloak.org/t/keycloak-is-adding-adding-port-80-to-https-urls/11808/10 "2022-08-15T14:14:20Z")

</div>

making progress, removed the snippet and running http-dump

```auto
GET /admin/ HTTP/1.1
Host: keycloak. *********.com
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Sec-Ch-Ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "macOS"
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
Use-Forwarded-Headers: “true”
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36
X-Forwarded-For: 1.2.3.4
X-Forwarded-Host: keycloak. *********.com
X-Forwarded-Port: 80
X-Forwarded-Proto: https
X-Forwarded-Scheme: https
X-Original-Forwarded-For: 1.2.3.4
X-Real-Ip: 1.2.3.4
X-Request-Id: ***********
X-Scheme: https

```

So Basically what I need is to change **X-Forwarded-Port: 80** to **X-Forwarded-Port: 443**

The tls gets terminated before it hits the ingress which is why I have https but communicating on 443

---

<div class="post-metadata">

**Author:** ![RbBrDkie](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rbbrdkie/32/6246_2.png) [@RbBrDkie](https://forum.keycloak.org/u/RbBrDkie)\
**Post date:** [August 15, 2022, 2:38pm UTC](https://forum.keycloak.org/t/keycloak-is-adding-adding-port-80-to-https-urls/11808/11 "2022-08-15T14:38:18Z")

</div>

[quote=“RbBrDkie, post:10, topic:11808”]  
I added back the snippet to set the port then it duplicates the port header which is why it didn’t work I guess

```auto
GET /admin/ HTTP/1.1
Host: keycloak. *********.com
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Sec-Ch-Ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "macOS"
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
Use-Forwarded-Headers: “true”
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36
X-Forwarded-For: 1.2.3.4
X-Forwarded-Host: keycloak. *********.com
X-Forwarded-Port: 80
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Forwarded-Scheme: https
X-Original-Forwarded-For: 1.2.3.4
X-Real-Ip: 1.2.3.4
X-Request-Id: ***********
X-Scheme: https

```

---

<div class="post-metadata">

**Author:** ![RbBrDkie](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rbbrdkie/32/6246_2.png) [@RbBrDkie](https://forum.keycloak.org/u/RbBrDkie)\
**Post date:** [August 17, 2022, 12:51pm UTC](https://forum.keycloak.org/t/keycloak-is-adding-adding-port-80-to-https-urls/11808/12 "2022-08-17T12:51:28Z")

</div>

finally got it working.

KC\_PROXY=none

I also added tls in the backend with selfsigned crt but don’t think that had an effect

---

<div class="post-metadata">

**Author:** ![john047](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/john047/32/7143_2.png) [@john047](https://forum.keycloak.org/u/john047)\
**Post date:** [December 2, 2022, 7:21am UTC](https://forum.keycloak.org/t/keycloak-is-adding-adding-port-80-to-https-urls/11808/13 "2022-12-02T07:21:51Z")

</div>

Hi,

How to use daime/http-dump:latest tool?