I am not able to access keycloak cookies even being on same parent domain in incognito mode

Configuring the server
1

I have two client application one is hosted on for example
client 1 is hosted on xyz.com and client 2 is hosted on subdomain. abc.com the keycloak server is hosted on parent domain of abc (cannot add dot com due to limitations)

What issue I am facing with both these application is when client 1 is trying to integrate the client 2 via iFrame the KC cookies are blocked and we get error like [KEYCLOAK] 3rd party cookies aren't supported by this browser. checkLoginIframe and silent check-sso are not available.

I have created 3rd application which I have hosted on parent domain of abc where I have integrated client 2 via iFrame but in this case the KC cookies are working fine.

Here the communication remains between client 2 and key cloak, then why am I facing the cookie related problem even being on same domain

Can anyone share inputs on this?

2

This sounds like you are inviting xss vulnerabilities.

Choosing a Domain Name - Kanidm Administration describes fairly well how to choose a secure domain naming structure for your login infrastructure.

3

The above domains are mentioned as a part of an example and the original issue is between keycloak’s communication is not happening within iframe and the cross origins in browser’s incognito tab, do anyone know an alternate solution to resolve cookie block issue?