State boundaries matter

When Django relies on Keycloak, teams must decide how Django sessions relate to Keycloak sessions and tokens. A common mistake is to validate login once and ignore session lifecycle alignment. This creates confusing behavior during logout, password changes, MFA enforcement, or account disablement.

Practical model

Let Keycloak authenticate the user and issue tokens. Let Django create an application session after successful validation. Keep token storage minimal, secure, and only as long-lived as required. Align Django session timeout with Keycloak session policy and define how forced logout or disabled users are handled.

Checklist

  • Use secure cookies and HTTPS-only session settings.
  • Validate issuer, audience, expiry, and signature.
  • Implement logout that clears Django session and redirects to Keycloak logout.
  • Re-check user status for sensitive actions when risk requires it.

Clear state ownership makes login behavior understandable during incidents and audits.