Skip to content

Keycloak JS and CSS is not loading with nGinx Reverse proxy context path #46018

Closed

Description

@nshah14285

Before reporting an issue

  • I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

No response

Describe the bug

Hello,

Running keycloak latest version 26.5.2 behind nGinx reverse proxy using context path.

When we access the url https://test.example.com/kc the page only display this "Loading the Administration Console" with white background, JS and CSS is not loading throw 404 error.

Below is the nGinx config.

location /kc/ {
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host host;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Port 443;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

Keycloak command:

./kc.sh start-dev --hostname=https://test.example.com/kc --hostname-backchannel-dynamic=true --proxy-headers=xforwarded --hostname-debug=true --http-port=8080

Even I have checked the issues mentioned by the others but it didn't worked.

If anything is missing in the nGinx config or keycloak command then please let me know.

Any help would be appreciated.

Thank You,
Nishit Shah

Version

26.5.2

Regression

  • The issue is a regression

Expected behavior

It should load the page properly.

Actual behavior

It should load the page properly.

How to Reproduce?

nGinx config mentioned above.

Anything else?

No response

Activity

  1. added theissue type on Feb 4, 2026
  2. shawkins commented on Feb 4, 2026

    @shawkins
    Contributor

    Seems similar to #45064

    Please use http-access-log-enabled=true and http-access-log-pattern=long and provide the log of requests hitting the Keycloak server.

  3. nshah14285 commented on Feb 4, 2026

    @nshah14285
    Author

    @shawkins

    Keycloak command run as:

    ./kc.sh start-dev --hostname=https://test.example.com/kc --hostname-backchannel-dynamic=true --proxy-headers=xforwarded --hostname-debug=true --http-port=8080 --http-access-log-enabled=true --http-access-log-pattern=long

    Below is the logs as requested.

    2026-02-04 16:32:55,801 INFO [org.keycloak.http.access-log] (executor-thread-1)
    GET /kc/ HTTP/1.1
    Connection: upgrade
    X-Real-IP: 36.255.88.223
    X-Forwarded-For: 36.255.88.223
    upgrade-insecure-requests: 1
    user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
    accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
    sec-fetch-site: none
    sec-fetch-mode: navigate
    sec-fetch-user: ?1
    sec-fetch-dest: document
    sec-ch-ua: "Google Chrome";v="143", "Chromium";v="143", "Not A(Brand";v="24"
    sec-ch-ua-mobile: ?0
    sec-ch-ua-platform: "Linux"
    accept-encoding: gzip, deflate, br, zstd
    accept-language: en-US,en;q=0.9
    priority: u=0, i
    Host: host
    X-Forwarded-Trusted-Proxy: true
    2026-02-04 16:32:56,064 INFO [org.keycloak.http.access-log] (executor-thread-1)
    GET /kc/admin/ HTTP/1.1
    Connection: upgrade
    X-Real-IP: 36.255.88.223
    X-Forwarded-For: 36.255.88.223
    upgrade-insecure-requests: 1
    user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
    accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
    sec-fetch-site: none
    sec-fetch-mode: navigate
    sec-fetch-user: ?1
    sec-fetch-dest: document
    sec-ch-ua: "Google Chrome";v="143", "Chromium";v="143", "Not A(Brand";v="24"
    sec-ch-ua-mobile: ?0
    sec-ch-ua-platform: "Linux"
    accept-encoding: gzip, deflate, br, zstd
    accept-language: en-US,en;q=0.9
    priority: u=0, i
    Host: host
    X-Forwarded-Trusted-Proxy: true
    2026-02-04 16:32:56,367 INFO [org.keycloak.http.access-log] (executor-thread-1)
    GET /kc/admin/master/console/ HTTP/1.1
    Connection: upgrade
    X-Real-IP: 36.255.88.223
    X-Forwarded-For: 36.255.88.223
    upgrade-insecure-requests: 1
    user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
    accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
    sec-fetch-site: none
    sec-fetch-mode: navigate
    sec-fetch-user: ?1
    sec-fetch-dest: document
    sec-ch-ua: "Google Chrome";v="143", "Chromium";v="143", "Not A(Brand";v="24"
    sec-ch-ua-mobile: ?0
    sec-ch-ua-platform: "Linux"
    accept-encoding: gzip, deflate, br, zstd
    accept-language: en-US,en;q=0.9
    priority: u=0, i
    Host: host
    X-Forwarded-Trusted-Proxy: true

  4. shawkins commented on Feb 4, 2026

    @shawkins
    Contributor

    @nshah14285 is that it? If so it would mean that the resource requests are not reaching the keycloak server.

    Can you provide an example of a client side url that is producing a 404 and confirm whether that is even reaching the keycloak server?

  5. nshah14285 commented on Feb 4, 2026

    @nshah14285
    Author

    @shawkins

    It looks like https://domain/kc/ reaches to keycloak server but the resources JS & CSS is not loading.

    Please find attached screenshot.

    Image
  6. 11 remaining items

  7. keycloak-github-bot commented on Feb 10, 2026

    @keycloak-github-bot

    Thanks for reporting this issue, but there is insufficient information or lack of steps to reproduce.

    Please provide additional details, otherwise this issue will be automatically closed within 14 days.

  8. nshah14285 commented on Feb 10, 2026

    @nshah14285
    Author

    @shawkins

    Also, there seems to be a mismatch between the log and start-dev options shown in #46018 (comment) - the requests hitting the keycloak server have a context path of /kc, but start-dev is not configured to have an http-relative-path of /kc

    /kc is define in the hostname parameter. I have also tried passing http-relative-path=/kc but that was giving the same 404 for JS and CSS .

    Keycloak command run as:

    ./kc.sh start-dev --hostname=https://domain.com/kc --http-relative-path=/kc --hostname-backchannel-dynamic=true --proxy-headers=xforwarded --hostname-debug=true --http-port=8080 --http-access-log-enabled=true --http-access-log-pattern=long --log-level=debug --log="console,file" --log-file=data/log/access.log

    Below is the keycloak access log

    2026-02-10 13:31:24,188 DEBUG [io.netty.util.Recycler] (vert.x-eventloop-thread-5) -Dio.netty.recycler.maxCapacityPerThread: 4096
    2026-02-10 13:31:24,189 DEBUG [io.netty.util.Recycler] (vert.x-eventloop-thread-5) -Dio.netty.recycler.ratio: 8
    2026-02-10 13:31:24,189 DEBUG [io.netty.util.Recycler] (vert.x-eventloop-thread-5) -Dio.netty.recycler.chunkSize: 32
    2026-02-10 13:31:24,189 DEBUG [io.netty.util.Recycler] (vert.x-eventloop-thread-5) -Dio.netty.recycler.blocking: false
    2026-02-10 13:31:24,189 DEBUG [io.netty.util.Recycler] (vert.x-eventloop-thread-5) -Dio.netty.recycler.batchFastThreadLocalOnly: true
    2026-02-10 13:31:24,198 DEBUG [io.netty.buffer.AbstractByteBuf] (vert.x-eventloop-thread-5) -Dio.netty.buffer.checkAccessible: true
    2026-02-10 13:31:24,198 DEBUG [io.netty.buffer.AbstractByteBuf] (vert.x-eventloop-thread-5) -Dio.netty.buffer.checkBounds: true
    2026-02-10 13:31:24,199 DEBUG [io.netty.util.ResourceLeakDetectorFactory] (vert.x-eventloop-thread-5) Loaded default ResourceLeakDetector: io.netty.util.ResourceLeakDetector@157d40a1
    2026-02-10 13:31:24,244 DEBUG [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-5) Using X-Forwarded-For to set for host to 68.56.24.2 and for port to 47052
    2026-02-10 13:31:24,244 DEBUG [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-5) Recalculated absoluteURI to http://domain.com/kc/
    2026-02-10 13:31:24,253 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) new JtaTransactionWrapper. Was existing transaction suspended: false Request Context: HTTP GET /
    2026-02-10 13:31:24,259 DEBUG [org.keycloak.models.cache.infinispan.InfinispanUserCacheProviderFactory] (executor-thread-1) Registered cluster listeners
    2026-02-10 13:31:24,264 DEBUG [org.hibernate.orm.jdbc] (executor-thread-1) HHH100016: 'hibernate.connection.provider_disables_autocommit' was enabled. This setting should only be enabled when JDBC Connections obtained by Hibernate from the ConnectionProvider have auto-commit disabled. Enabling this setting when connections have auto-commit enabled leads to execution of SQL operations outside of any JDBC transaction.
    2026-02-10 13:31:24,272 DEBUG [org.hibernate.SQL] (executor-thread-1) select count(ue1_0.ID) from USER_ENTITY ue1_0 where ue1_0.REALM_ID=?
    2026-02-10 13:31:24,272 FINE [org.postgresql.jdbc.PgConnection] (executor-thread-1) setAutoCommit = false
    2026-02-10 13:31:24,276 DEBUG [org.keycloak.executors.DefaultExecutorsProviderFactory] (executor-thread-1) We are not in managed environment. Executor 'java:jboss/ee/concurrency/executor/default' was not available.
    2026-02-10 13:31:24,276 DEBUG [org.keycloak.executors.DefaultExecutorsProviderFactory] (executor-thread-1) Creating pool for task 'storage-provider-threads': min=4, max=64
    2026-02-10 13:31:24,284 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) JtaTransactionWrapper commit. Request Context: HTTP GET /
    2026-02-10 13:31:24,285 FINE [org.postgresql.jdbc.PgConnection] (executor-thread-1) setAutoCommit = true
    2026-02-10 13:31:24,285 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) JtaTransactionWrapper end. Request Context: HTTP GET /
    2026-02-10 13:31:24,285 DEBUG [org.hibernate.session.metrics] (executor-thread-1) HHH000401: Logging session metrics:
    231334 ns acquiring 1 JDBC connections
    8114 ns releasing 1 JDBC connections
    315653 ns preparing 1 JDBC statements
    909929 ns executing 1 JDBC statements
    0 ns executing 0 JDBC batches
    0 ns performing 0 second-level cache puts
    0 ns performing 0 second-level cache hits
    0 ns performing 0 second-level cache misses
    0 ns executing 0 flushes (flushing a total of 0 entities and 0 collections)
    4580 ns executing 1 pre-partial-flushes
    4547 ns executing 1 partial-flushes (flushing a total of 0 entities and 0 collections)

    2026-02-10 13:31:24,289 INFO [org.keycloak.http.access-log] (executor-thread-1)
    GET /kc/ HTTP/1.1
    Connection: upgrade
    X-Real-IP: 68.56.24.2
    X-Forwarded-For: 68.56.24.2
    upgrade-insecure-requests: 1
    user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
    accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
    sec-fetch-site: none
    sec-fetch-mode: navigate
    sec-fetch-user: ?1
    sec-fetch-dest: document
    sec-ch-ua: "Google Chrome";v="143", "Chromium";v="143", "Not A(Brand";v="24"
    sec-ch-ua-mobile: ?0
    sec-ch-ua-platform: "Linux"
    accept-encoding: gzip, deflate, br, zstd
    accept-language: en-US,en;q=0.9
    priority: u=0, i
    Host: domain.com
    X-Forwarded-Trusted-Proxy: true
    2026-02-10 13:31:24,545 DEBUG [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-7) Using X-Forwarded-For to set for host to 68.56.24.2 and for port to 47062
    2026-02-10 13:31:24,545 DEBUG [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-7) Recalculated absoluteURI to http://domain.com/kc/admin/
    2026-02-10 13:31:24,552 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) new JtaTransactionWrapper. Was existing transaction suspended: false Request Context: HTTP GET /admin/
    2026-02-10 13:31:24,557 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) JtaTransactionWrapper commit. Request Context: HTTP GET /admin/
    2026-02-10 13:31:24,558 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) JtaTransactionWrapper end. Request Context: HTTP GET /admin/
    2026-02-10 13:31:24,558 INFO [org.keycloak.http.access-log] (executor-thread-1)
    GET /kc/admin/ HTTP/1.1
    Connection: upgrade
    X-Real-IP: 68.56.24.2
    X-Forwarded-For: 68.56.24.2
    upgrade-insecure-requests: 1
    user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
    accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
    sec-fetch-site: none
    sec-fetch-mode: navigate
    sec-fetch-user: ?1
    sec-fetch-dest: document
    sec-ch-ua: "Google Chrome";v="143", "Chromium";v="143", "Not A(Brand";v="24"
    sec-ch-ua-mobile: ?0
    sec-ch-ua-platform: "Linux"
    accept-encoding: gzip, deflate, br, zstd
    accept-language: en-US,en;q=0.9
    priority: u=0, i
    Host: domain.com
    X-Forwarded-Trusted-Proxy: true
    2026-02-10 13:31:24,820 DEBUG [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-6) Using X-Forwarded-For to set for host to 68.56.24.2 and for port to 47092
    2026-02-10 13:31:24,820 DEBUG [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-6) Recalculated absoluteURI to http://domain.com/kc/admin/master/console/
    2026-02-10 13:31:24,824 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) new JtaTransactionWrapper. Was existing transaction suspended: false Request Context: HTTP GET /admin/master/console/
    2026-02-10 13:31:24,957 FINE [freemarker.cache] (executor-thread-1) Couldn't find template in cache for "index.ftl"("en_US", UTF-8, parsed); will try to load it.
    2026-02-10 13:31:24,958 FINE [freemarker.cache] (executor-thread-1) TemplateLoader.findTemplateSource("index_en_US.ftl"): Not found
    2026-02-10 13:31:24,958 FINE [freemarker.cache] (executor-thread-1) TemplateLoader.findTemplateSource("index_en.ftl"): Not found
    2026-02-10 13:31:24,959 FINE [freemarker.cache] (executor-thread-1) TemplateLoader.findTemplateSource("index.ftl"): Found
    2026-02-10 13:31:24,959 FINE [freemarker.cache] (executor-thread-1) Loading template for "index.ftl"("en_US", UTF-8, parsed) from "jar:file:/home/test/keycloak/keycloak-26.5.2/lib/lib/main/org.keycloak.keycloak-admin-ui-26.5.2.jar!/theme/keycloak.v2/admin/index.ftl"
    2026-02-10 13:31:25,020 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) JtaTransactionWrapper commit. Request Context: HTTP GET /admin/master/console/
    2026-02-10 13:31:25,021 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) JtaTransactionWrapper end. Request Context: HTTP GET /admin/master/console/
    2026-02-10 13:31:25,026 INFO [org.keycloak.http.access-log] (executor-thread-1)
    GET /kc/admin/master/console/ HTTP/1.1
    Connection: upgrade
    X-Real-IP: 68.56.24.2
    X-Forwarded-For: 68.56.24.2
    upgrade-insecure-requests: 1
    user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
    accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
    sec-fetch-site: none
    sec-fetch-mode: navigate
    sec-fetch-user: ?1
    sec-fetch-dest: document
    sec-ch-ua: "Google Chrome";v="143", "Chromium";v="143", "Not A(Brand";v="24"
    sec-ch-ua-mobile: ?0
    sec-ch-ua-platform: "Linux"
    accept-encoding: gzip, deflate, br, zstd
    accept-language: en-US,en;q=0.9
    priority: u=0, i
    Host: domain.com
    X-Forwarded-Trusted-Proxy: true

    nGinx access log

    68.56.24.2 - - [10/Feb/2026:13:31:23 +0000] "GET /kc HTTP/2.0" 301 162 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    68.56.24.2 - - [10/Feb/2026:13:31:24 +0000] "GET /kc/ HTTP/2.0" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    68.56.24.2 - - [10/Feb/2026:13:31:24 +0000] "GET /kc/admin/ HTTP/2.0" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    68.56.24.2 - - [10/Feb/2026:13:31:25 +0000] "GET /kc/admin/master/console/ HTTP/2.0" 200 3850 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    68.56.24.2 - - [10/Feb/2026:13:31:25 +0000] "GET /kc/resources/0o0iy/admin/keycloak.v2/assets/main-DmoViYol.css HTTP/2.0" 404 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    68.56.24.2 - - [10/Feb/2026:13:31:25 +0000] "GET /kc/resources/0o0iy/common/keycloak/vendor/web-crypto-shim/web-crypto-shim.js HTTP/2.0" 404 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
    68.56.24.2 - - [10/Feb/2026:13:31:25 +0000] "GET /kc/resources/0o0iy/admin/keycloak.v2/assets/main-meeoogRY.js HTTP/2.0" 404 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"

  9. shawkins commented on Feb 10, 2026

    @shawkins
    Contributor

    @nshah14285 this should confirm that the problem is with the nginx configuration. If the 404 requests are not reaching the Keycloak server, then your issue is with the proxy configuration. For example try using curl or other client to issue the resource request directly to the Keycloak server - curl -v http://localhost:8080/kc/resources/...

  10. nshah14285 commented on Feb 10, 2026

    @nshah14285
    Author

    @shawkins

    http://localhost:8080/kc/resources/0o0iy/admin/keycloak.v2/assets/main-DmoViYol.css

    Localhost request works but through nGinx reverse proxy using keycloak relative path /kc resources are not loading.
    What could be the issue with nGinx config, any idea? I have already pasted the nginx config in this comment.

  11. locked and limited conversation to collaborators on Feb 10, 2026
  12. converted this issue into a discussion #46186 on Feb 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/bugCategorizes a PR related to a bug

    Type

    Fields

    No fields configured for bug.

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions