Keycloak JS and CSS is not loading with nGinx Reverse proxy context path #46186

nshah14285 · 2026-02-04T14:50:16Z

nshah14285
Feb 4, 2026

Before reporting an issue

I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

No response

Describe the bug

Hello,

Running keycloak latest version 26.5.2 behind nGinx reverse proxy using context path.

When we access the url https://test.example.com/kc the page only display this "Loading the Administration Console" with white background, JS and CSS is not loading throw 404 error.

Below is the nGinx config.

location /kc/ {
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host host;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Port 443;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

Keycloak command:

./kc.sh start-dev --hostname=https://test.example.com/kc --hostname-backchannel-dynamic=true --proxy-headers=xforwarded --hostname-debug=true --http-port=8080

Even I have checked the issues mentioned by the others but it didn't worked.

If anything is missing in the nGinx config or keycloak command then please let me know.

Any help would be appreciated.

Thank You,
Nishit Shah

Version

26.5.2

Regression

The issue is a regression

Expected behavior

It should load the page properly.

Actual behavior

It should load the page properly.

How to Reproduce?

nGinx config mentioned above.

Anything else?

No response

shawkins · 2026-02-04T15:09:38Z

shawkins
Feb 4, 2026
Collaborator

Seems similar to #45064

Please use http-access-log-enabled=true and http-access-log-pattern=long and provide the log of requests hitting the Keycloak server.

0 replies

nshah14285 · 2026-02-04T16:37:57Z

nshah14285
Feb 4, 2026
Author

@shawkins

Keycloak command run as:

./kc.sh start-dev --hostname=https://test.example.com/kc --hostname-backchannel-dynamic=true --proxy-headers=xforwarded --hostname-debug=true --http-port=8080 --http-access-log-enabled=true --http-access-log-pattern=long

Below is the logs as requested.

2026-02-04 16:32:55,801 INFO [org.keycloak.http.access-log] (executor-thread-1)
GET /kc/ HTTP/1.1
Connection: upgrade
X-Real-IP: 36.255.88.223
X-Forwarded-For: 36.255.88.223
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Google Chrome";v="143", "Chromium";v="143", "Not A(Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0, i
Host: host
X-Forwarded-Trusted-Proxy: true
2026-02-04 16:32:56,064 INFO [org.keycloak.http.access-log] (executor-thread-1)
GET /kc/admin/ HTTP/1.1
Connection: upgrade
X-Real-IP: 36.255.88.223
X-Forwarded-For: 36.255.88.223
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Google Chrome";v="143", "Chromium";v="143", "Not A(Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0, i
Host: host
X-Forwarded-Trusted-Proxy: true
2026-02-04 16:32:56,367 INFO [org.keycloak.http.access-log] (executor-thread-1)
GET /kc/admin/master/console/ HTTP/1.1
Connection: upgrade
X-Real-IP: 36.255.88.223
X-Forwarded-For: 36.255.88.223
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Google Chrome";v="143", "Chromium";v="143", "Not A(Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0, i
Host: host
X-Forwarded-Trusted-Proxy: true

0 replies

shawkins · 2026-02-04T18:13:02Z

shawkins
Feb 4, 2026
Collaborator

@nshah14285 is that it? If so it would mean that the resource requests are not reaching the keycloak server.

Can you provide an example of a client side url that is producing a 404 and confirm whether that is even reaching the keycloak server?

0 replies

nshah14285 · 2026-02-04T18:30:50Z

nshah14285
Feb 4, 2026
Author

@shawkins

It looks like https://domain/kc/ reaches to keycloak server but the resources JS & CSS is not loading.

Please find attached screenshot.

0 replies

shawkins · 2026-02-09T21:04:51Z

shawkins
Feb 9, 2026
Collaborator

The screenshot confirms the browser is seeing a 404. Can you confirm the question from #46018 (comment) - do you see a 404 in the access logs as well? If not, then your issue is definitely with nginx.

0 replies

nshah14285 · 2026-02-10T05:34:54Z

nshah14285
Feb 10, 2026
Author

@shawkins

Yes, 404 is getting logged in the nGinx access log.

68.56.24.2 - - [10/Feb/2026:05:30:49 +0000] "GET /kc/ HTTP/2.0" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
68.56.24.2 - - [10/Feb/2026:05:30:50 +0000] "GET /kc/admin/ HTTP/2.0" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
68.56.24.2 - - [10/Feb/2026:05:30:50 +0000] "GET /kc/admin/master/console/ HTTP/2.0" 200 3850 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
68.56.24.2 - - [10/Feb/2026:05:30:51 +0000] "GET /kc/resources/0o0iy/common/keycloak/vendor/web-crypto-shim/web-crypto-shim.js HTTP/2.0" 404 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
68.56.24.2 - - [10/Feb/2026:05:30:51 +0000] "GET /kc/resources/0o0iy/admin/keycloak.v2/assets/main-DmoViYol.css HTTP/2.0" 404 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
68.56.24.2 - - [10/Feb/2026:05:30:51 +0000] "GET /kc/resources/0o0iy/admin/keycloak.v2/assets/main-meeoogRY.js HTTP/2.0" 404 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
68.56.24.2 - - [10/Feb/2026:05:30:52 +0000] "GET /kc/resources/0o0iy/admin/keycloak.v2/favicon.svg HTTP/2.0" 404 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"

0 replies

shawkins · 2026-02-10T12:23:47Z

shawkins
Feb 10, 2026
Collaborator

Yes, 404 is getting logged in the nGinx access log.

And what is in the Keycloak access log?

Also, there seems to be a mismatch between the log and start-dev options shown in #46018 (comment) - the requests hitting the keycloak server have a context path of /kc, but start-dev is not configured to have an http-relative-path of /kc

0 replies

2026-02-10T12:24:07Z

keycloak-github-bot[bot]
bot Feb 10, 2026

Thanks for reporting this issue, but there is insufficient information or lack of steps to reproduce.

Please provide additional details, otherwise this issue will be automatically closed within 14 days.

0 replies

nshah14285 · 2026-02-10T13:39:47Z

nshah14285
Feb 10, 2026
Author

@shawkins

Also, there seems to be a mismatch between the log and start-dev options shown in #46018 (comment) - the requests hitting the keycloak server have a context path of /kc, but start-dev is not configured to have an http-relative-path of /kc

/kc is define in the hostname parameter. I have also tried passing http-relative-path=/kc but that was giving the same 404 for JS and CSS .

Keycloak command run as:

./kc.sh start-dev --hostname=https://domain.com/kc --http-relative-path=/kc --hostname-backchannel-dynamic=true --proxy-headers=xforwarded --hostname-debug=true --http-port=8080 --http-access-log-enabled=true --http-access-log-pattern=long --log-level=debug --log="console,file" --log-file=data/log/access.log

Below is the keycloak access log

2026-02-10 13:31:24,188 DEBUG [io.netty.util.Recycler] (vert.x-eventloop-thread-5) -Dio.netty.recycler.maxCapacityPerThread: 4096
2026-02-10 13:31:24,189 DEBUG [io.netty.util.Recycler] (vert.x-eventloop-thread-5) -Dio.netty.recycler.ratio: 8
2026-02-10 13:31:24,189 DEBUG [io.netty.util.Recycler] (vert.x-eventloop-thread-5) -Dio.netty.recycler.chunkSize: 32
2026-02-10 13:31:24,189 DEBUG [io.netty.util.Recycler] (vert.x-eventloop-thread-5) -Dio.netty.recycler.blocking: false
2026-02-10 13:31:24,189 DEBUG [io.netty.util.Recycler] (vert.x-eventloop-thread-5) -Dio.netty.recycler.batchFastThreadLocalOnly: true
2026-02-10 13:31:24,198 DEBUG [io.netty.buffer.AbstractByteBuf] (vert.x-eventloop-thread-5) -Dio.netty.buffer.checkAccessible: true
2026-02-10 13:31:24,198 DEBUG [io.netty.buffer.AbstractByteBuf] (vert.x-eventloop-thread-5) -Dio.netty.buffer.checkBounds: true
2026-02-10 13:31:24,199 DEBUG [io.netty.util.ResourceLeakDetectorFactory] (vert.x-eventloop-thread-5) Loaded default ResourceLeakDetector: io.netty.util.ResourceLeakDetector@157d40a1
2026-02-10 13:31:24,244 DEBUG [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-5) Using X-Forwarded-For to set for host to 68.56.24.2 and for port to 47052
2026-02-10 13:31:24,244 DEBUG [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-5) Recalculated absoluteURI to http://domain.com/kc/
2026-02-10 13:31:24,253 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) new JtaTransactionWrapper. Was existing transaction suspended: false Request Context: HTTP GET /
2026-02-10 13:31:24,259 DEBUG [org.keycloak.models.cache.infinispan.InfinispanUserCacheProviderFactory] (executor-thread-1) Registered cluster listeners
2026-02-10 13:31:24,264 DEBUG [org.hibernate.orm.jdbc] (executor-thread-1) HHH100016: 'hibernate.connection.provider_disables_autocommit' was enabled. This setting should only be enabled when JDBC Connections obtained by Hibernate from the ConnectionProvider have auto-commit disabled. Enabling this setting when connections have auto-commit enabled leads to execution of SQL operations outside of any JDBC transaction.
2026-02-10 13:31:24,272 DEBUG [org.hibernate.SQL] (executor-thread-1) select count(ue1_0.ID) from USER_ENTITY ue1_0 where ue1_0.REALM_ID=?
2026-02-10 13:31:24,272 FINE [org.postgresql.jdbc.PgConnection] (executor-thread-1) setAutoCommit = false
2026-02-10 13:31:24,276 DEBUG [org.keycloak.executors.DefaultExecutorsProviderFactory] (executor-thread-1) We are not in managed environment. Executor 'java:jboss/ee/concurrency/executor/default' was not available.
2026-02-10 13:31:24,276 DEBUG [org.keycloak.executors.DefaultExecutorsProviderFactory] (executor-thread-1) Creating pool for task 'storage-provider-threads': min=4, max=64
2026-02-10 13:31:24,284 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) JtaTransactionWrapper commit. Request Context: HTTP GET /
2026-02-10 13:31:24,285 FINE [org.postgresql.jdbc.PgConnection] (executor-thread-1) setAutoCommit = true
2026-02-10 13:31:24,285 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) JtaTransactionWrapper end. Request Context: HTTP GET /
2026-02-10 13:31:24,285 DEBUG [org.hibernate.session.metrics] (executor-thread-1) HHH000401: Logging session metrics:
231334 ns acquiring 1 JDBC connections
8114 ns releasing 1 JDBC connections
315653 ns preparing 1 JDBC statements
909929 ns executing 1 JDBC statements
0 ns executing 0 JDBC batches
0 ns performing 0 second-level cache puts
0 ns performing 0 second-level cache hits
0 ns performing 0 second-level cache misses
0 ns executing 0 flushes (flushing a total of 0 entities and 0 collections)
4580 ns executing 1 pre-partial-flushes
4547 ns executing 1 partial-flushes (flushing a total of 0 entities and 0 collections)

2026-02-10 13:31:24,289 INFO [org.keycloak.http.access-log] (executor-thread-1)
GET /kc/ HTTP/1.1
Connection: upgrade
X-Real-IP: 68.56.24.2
X-Forwarded-For: 68.56.24.2
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Google Chrome";v="143", "Chromium";v="143", "Not A(Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0, i
Host: domain.com
X-Forwarded-Trusted-Proxy: true
2026-02-10 13:31:24,545 DEBUG [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-7) Using X-Forwarded-For to set for host to 68.56.24.2 and for port to 47062
2026-02-10 13:31:24,545 DEBUG [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-7) Recalculated absoluteURI to http://domain.com/kc/admin/
2026-02-10 13:31:24,552 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) new JtaTransactionWrapper. Was existing transaction suspended: false Request Context: HTTP GET /admin/
2026-02-10 13:31:24,557 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) JtaTransactionWrapper commit. Request Context: HTTP GET /admin/
2026-02-10 13:31:24,558 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) JtaTransactionWrapper end. Request Context: HTTP GET /admin/
2026-02-10 13:31:24,558 INFO [org.keycloak.http.access-log] (executor-thread-1)
GET /kc/admin/ HTTP/1.1
Connection: upgrade
X-Real-IP: 68.56.24.2
X-Forwarded-For: 68.56.24.2
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Google Chrome";v="143", "Chromium";v="143", "Not A(Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0, i
Host: domain.com
X-Forwarded-Trusted-Proxy: true
2026-02-10 13:31:24,820 DEBUG [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-6) Using X-Forwarded-For to set for host to 68.56.24.2 and for port to 47092
2026-02-10 13:31:24,820 DEBUG [io.quarkus.vertx.http.runtime.ForwardedParser] (vert.x-eventloop-thread-6) Recalculated absoluteURI to http://domain.com/kc/admin/master/console/
2026-02-10 13:31:24,824 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) new JtaTransactionWrapper. Was existing transaction suspended: false Request Context: HTTP GET /admin/master/console/
2026-02-10 13:31:24,957 FINE [freemarker.cache] (executor-thread-1) Couldn't find template in cache for "index.ftl"("en_US", UTF-8, parsed); will try to load it.
2026-02-10 13:31:24,958 FINE [freemarker.cache] (executor-thread-1) TemplateLoader.findTemplateSource("index_en_US.ftl"): Not found
2026-02-10 13:31:24,958 FINE [freemarker.cache] (executor-thread-1) TemplateLoader.findTemplateSource("index_en.ftl"): Not found
2026-02-10 13:31:24,959 FINE [freemarker.cache] (executor-thread-1) TemplateLoader.findTemplateSource("index.ftl"): Found
2026-02-10 13:31:24,959 FINE [freemarker.cache] (executor-thread-1) Loading template for "index.ftl"("en_US", UTF-8, parsed) from "jar:file:/home/test/keycloak/keycloak-26.5.2/lib/lib/main/org.keycloak.keycloak-admin-ui-26.5.2.jar!/theme/keycloak.v2/admin/index.ftl"
2026-02-10 13:31:25,020 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) JtaTransactionWrapper commit. Request Context: HTTP GET /admin/master/console/
2026-02-10 13:31:25,021 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-1) JtaTransactionWrapper end. Request Context: HTTP GET /admin/master/console/
2026-02-10 13:31:25,026 INFO [org.keycloak.http.access-log] (executor-thread-1)
GET /kc/admin/master/console/ HTTP/1.1
Connection: upgrade
X-Real-IP: 68.56.24.2
X-Forwarded-For: 68.56.24.2
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Google Chrome";v="143", "Chromium";v="143", "Not A(Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
priority: u=0, i
Host: domain.com
X-Forwarded-Trusted-Proxy: true

nGinx access log

68.56.24.2 - - [10/Feb/2026:13:31:23 +0000] "GET /kc HTTP/2.0" 301 162 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
68.56.24.2 - - [10/Feb/2026:13:31:24 +0000] "GET /kc/ HTTP/2.0" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
68.56.24.2 - - [10/Feb/2026:13:31:24 +0000] "GET /kc/admin/ HTTP/2.0" 302 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
68.56.24.2 - - [10/Feb/2026:13:31:25 +0000] "GET /kc/admin/master/console/ HTTP/2.0" 200 3850 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
68.56.24.2 - - [10/Feb/2026:13:31:25 +0000] "GET /kc/resources/0o0iy/admin/keycloak.v2/assets/main-DmoViYol.css HTTP/2.0" 404 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
68.56.24.2 - - [10/Feb/2026:13:31:25 +0000] "GET /kc/resources/0o0iy/common/keycloak/vendor/web-crypto-shim/web-crypto-shim.js HTTP/2.0" 404 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
68.56.24.2 - - [10/Feb/2026:13:31:25 +0000] "GET /kc/resources/0o0iy/admin/keycloak.v2/assets/main-meeoogRY.js HTTP/2.0" 404 548 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"

0 replies

shawkins · 2026-02-10T15:12:17Z

shawkins
Feb 10, 2026
Collaborator

@nshah14285 this should confirm that the problem is with the nginx configuration. If the 404 requests are not reaching the Keycloak server, then your issue is with the proxy configuration. For example try using curl or other client to issue the resource request directly to the Keycloak server - curl -v http://localhost:8080/kc/resources/...

0 replies

nshah14285 · 2026-02-10T15:52:16Z

nshah14285
Feb 10, 2026
Author

@shawkins

http://localhost:8080/kc/resources/0o0iy/admin/keycloak.v2/assets/main-DmoViYol.css

Localhost request works but through nGinx reverse proxy using keycloak relative path /kc resources are not loading.
What could be the issue with nGinx config, any idea? I have already pasted the nginx config in this comment.

1 reply

shawkins Feb 10, 2026
Collaborator

Moved to a discussion as this is not specifically a Keycloak issue.

What could be the issue with nGinx config, any idea? I have already pasted the nginx config in this #46018 (comment).

I'm not an expert on nginx, but you should try to simplify as much as possible. For example tyr removing:

proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

nshah14285 · 2026-02-10T17:51:29Z

nshah14285
Feb 10, 2026
Author

@shawkins

At nginx, I have tried putting this simple config

location /kc/ {
proxy_pass http://localhost:8080;
}

The issue persists: JS and CSS are still not loading.
It looks like Nginx is treating the /kc/resources path as a directory and not forwarding the request to keycloak.

Based on issues reported by others, this Nginx reverse-proxy problem seems to have started with Keycloak version 25 and above.

Has anyone on your team encountered or resolved this issue before?

3 replies

shawkins Feb 10, 2026
Collaborator

Has anyone on your team encountered or resolved this issue before?

No, and I also do local testing with nginx and haven't encountered this behavior. For example in a similar TLS termination scenario with http-relative-path set to keycloak, I have used:

        location /keycloak/ {
            proxy_pass http://localhost:8080/keycloak/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Port $server_port;
        }

nshah14285 Feb 11, 2026
Author

@shawkins

I've identified the issue.

Due to another location block defined in the same domain Nginx configuration, Keycloak's JS and CSS files were not loading properly.

After removing that location block, JS and CSS files are now loading correctly.

Thank You for your help and support, it's greatly appreciated.

shawkins Feb 11, 2026
Collaborator

Great, hopefully this will help anyone else with a similar situation.

Keycloak JS and CSS is not loading with nGinx Reverse proxy context path #46186

Uh oh!

nshah14285 Feb 4, 2026

Before reporting an issue

Area

Describe the bug

Version

Regression

Expected behavior

Actual behavior

How to Reproduce?

Anything else?

Replies: 12 comments · 4 replies

Uh oh!

shawkins Feb 4, 2026 Collaborator

Uh oh!

nshah14285 Feb 4, 2026 Author

Uh oh!

shawkins Feb 4, 2026 Collaborator

Uh oh!

Uh oh!

nshah14285 Feb 4, 2026 Author

Uh oh!

shawkins Feb 9, 2026 Collaborator

Uh oh!

Uh oh!

nshah14285 Feb 10, 2026 Author

Uh oh!

Uh oh!

shawkins Feb 10, 2026 Collaborator

Uh oh!

keycloak-github-bot[bot] bot Feb 10, 2026

Uh oh!

Uh oh!

nshah14285 Feb 10, 2026 Author

Uh oh!

shawkins Feb 10, 2026 Collaborator

Uh oh!

Uh oh!

nshah14285 Feb 10, 2026 Author

Uh oh!

shawkins Feb 10, 2026 Collaborator

Uh oh!

nshah14285 Feb 10, 2026 Author

Uh oh!

shawkins Feb 10, 2026 Collaborator

Uh oh!

nshah14285 Feb 11, 2026 Author

Uh oh!

shawkins Feb 11, 2026 Collaborator

nshah14285
Feb 4, 2026

Replies: 12 comments 4 replies

shawkins
Feb 4, 2026
Collaborator

nshah14285
Feb 4, 2026
Author

shawkins
Feb 4, 2026
Collaborator

nshah14285
Feb 4, 2026
Author

shawkins
Feb 9, 2026
Collaborator

nshah14285
Feb 10, 2026
Author

shawkins
Feb 10, 2026
Collaborator

keycloak-github-bot[bot]
bot Feb 10, 2026

nshah14285
Feb 10, 2026
Author

shawkins
Feb 10, 2026
Collaborator

nshah14285
Feb 10, 2026
Author

shawkins Feb 10, 2026
Collaborator

nshah14285
Feb 10, 2026
Author

shawkins Feb 10, 2026
Collaborator

nshah14285 Feb 11, 2026
Author

shawkins Feb 11, 2026
Collaborator