I have a Spring Boot Application that uses the Keycloak adapters. I realized that the OAuth_Token_Request_State Cookie is always set to the root path '/' instead of the path the app is reachable on (let's say '/myapp').
I searched for my configuration error and found out that there is none - the path is hardcoded in the Adapter (org.keycloak.adapters.OAuthRequestAuthenticator#loginRedirect).

This feels very wrong to me, as it
a) exposes the cookie to other apps on that domain
b) forces all apps on that domain which use the Keycloak adapter to share the state cookie

Is this intended, and if yes, can anyone tell me a reason? Otherwise I'd create an issue.