Keycloak logout not working when using custom Docker image + Nginx reverse proxy

I’m running Keycloak 22.0.5 (Quarkus) in Docker with a custom image and facing issues with logout not working when I access it behind Nginx.

My dockerfile for keycloak

FROM quay.io/keycloak/keycloak:22.0.5
COPY realm-export.json /opt/keycloak/data/import/realm-export.json
COPY themes/ /opt/keycloak/themes/
EXPOSE 8080
ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "start-dev", \
"--import-realm", \
"--hostname-strict=false", \
"--https-port=8443", \
"--proxy=edge", \
"--http-relative-path=/auth", \
"--features=scripts", \
"-Dkeycloak.profile.feature.scripts=enabled"]


docker-compose.yaml service

okr-keycloak:
image: okr-keycloak:latest
container_name: okr-keycloak
ports:
- "31520:8080"
environment:
KEYCLOAK_ADMIN: admin
KEYCLOAK_ADMIN_PASSWORD: Zigm@2025
KC_DB: mysql
KC_DB_URL: jdbc:mysql://mysql:3306/keycloak
KC_DB_USERNAME: username
KC_DB_PASSWORD: password
KC_HOSTNAME: ip_host
KC_HOSTNAME_PORT: port_host
KC_FRONTEND_URL: "http://ip_hostort_host/auth"
KC_PROXY_HEADERS: xforwarded


and the nginx config for the keycloak in angular frontend

location /auth {
proxy_pass ${KEYCLOAK_URL};
proxy_set_header Host $host:$server_port;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
}


Login and backend API calls from my Angular frontend work correctly, but the logout flow doesn’t work as expected. The redirect URL generated during logout ignores the application’s port, instead of returning to http://ip:angular_port/auth, it redirects to http://ip/auth.

What configuration changes should I try to fix the Keycloak logout issue when running behind Nginx with the setup above?

What I tried

• Built a custom Keycloak image (quay.io/keycloak/keycloak:22.0.5) with --proxy=edge, --hostname-strict=false, and --http-relative-path=/auth.
• Configured KC_HOSTNAME, KC_HOSTNAME_PORT, KC_FRONTEND_URL and KC_PROXY_HEADERS=xforwarded in the Docker Compose service.
• Set up Nginx with a dynamic route for /auth that forwards the required headers (Host, X-Forwarded-For, X-Forwarded-Proto, X-Forwarded-Port).
• Verified that login and backend API calls from the Angular frontend work correctly.

What I expected

After logout, the user should be redirected to http://ip:angular_port/auth (including the angular's port).

What actually happens

Logout ignores the port and redirects to http://ip/auth, which breaks the flow.

Continue reading...