ory · hperl · Jul 13, 2026 · Jul 13, 2026
@@ -24,4 +24,4 @@ Head to [our blogpost](https://www.ory.com/choose-recommended-argon2-parameters-
 how this command and password checking in Ory Kratos works.
 
 If you encounter any problems like timeouts or out-of-memory errors, consolidate our
-[troubleshooting guide](../debug/performance-out-of-memory-password-hashing-argon2.md).
+[troubleshooting guide](/docs/oel/kratos/debug/performance-out-of-memory-password-hashing-argon2).
@@ -0,0 +1,14 @@
+---
+id: csrf
+title: CSRF troubleshooting
+---
+
+<head>
+  <link rel="canonical" href="https://www.ory.com/docs/oel/kratos/debug/csrf" />
+</head>
+
+```mdx-code-block
+import MyPartial from "@site/src/components/Shared/kratos/debug/csrf.mdx"
+
+<MyPartial />
+```
@@ -0,0 +1,14 @@
+---
+id: debug-docker-delve-ory-kratos
+title: Debugging Ory Kratos in Docker with Delve
+---
+
+<head>
+  <link rel="canonical" href="https://www.ory.com/docs/oel/kratos/debug/debug-docker-delve-ory-kratos" />
+</head>
+
+```mdx-code-block
+import MyPartial from "@site/src/components/Shared/kratos/debug/debug-docker-delve-ory-kratos.mdx"
+
+<MyPartial />
+```
@@ -0,0 +1,14 @@
+---
+id: performance-out-of-memory-password-hashing-argon2
+title: Performance problems and out of memory panics caused by password hashing
+---
+
+<head>
+  <link rel="canonical" href="https://www.ory.com/docs/oel/kratos/debug/performance-out-of-memory-password-hashing-argon2" />
+</head>
+
+```mdx-code-block
+import MyPartial from "@site/src/components/Shared/kratos/debug/performance-out-of-memory-password-hashing-argon2.md"
+
+<MyPartial />
+```
@@ -0,0 +1,14 @@
+---
+id: troubleshooting
+title: General troubleshooting
+---
+
+<head>
+  <link rel="canonical" href="https://www.ory.com/docs/oel/kratos/debug/troubleshooting" />
+</head>
+
+```mdx-code-block
+import MyPartial from "@site/src/components/Shared/kratos/debug/troubleshooting.md"
+
+<MyPartial />
+```
@@ -0,0 +1,14 @@
+---
+id: csrf
+title: CSRF troubleshooting
+---
+
+<head>
+  <link rel="canonical" href="https://www.ory.com/docs/oel/kratos/debug/csrf" />
+</head>
+
+```mdx-code-block
+import MyPartial from "@site/src/components/Shared/kratos/debug/csrf.mdx"
+
+<MyPartial />
+```
@@ -0,0 +1,14 @@
+---
+id: debug-docker-delve-ory-kratos
+title: Debugging Ory Kratos in Docker with Delve
+---
+
+<head>
+  <link rel="canonical" href="https://www.ory.com/docs/oel/kratos/debug/debug-docker-delve-ory-kratos" />
+</head>
+
+```mdx-code-block
+import MyPartial from "@site/src/components/Shared/kratos/debug/debug-docker-delve-ory-kratos.mdx"
+
+<MyPartial />
+```
@@ -0,0 +1,14 @@
+---
+id: performance-out-of-memory-password-hashing-argon2
+title: Performance problems and out of memory panics caused by password hashing
+---
+
+<head>
+  <link rel="canonical" href="https://www.ory.com/docs/oel/kratos/debug/performance-out-of-memory-password-hashing-argon2" />
+</head>
+
+```mdx-code-block
+import MyPartial from "@site/src/components/Shared/kratos/debug/performance-out-of-memory-password-hashing-argon2.md"
+
+<MyPartial />
+```
@@ -0,0 +1,14 @@
+---
+id: troubleshooting
+title: General troubleshooting
+---
+
+<head>
+  <link rel="canonical" href="https://www.ory.com/docs/oel/kratos/debug/troubleshooting" />
+</head>
+
+```mdx-code-block
+import MyPartial from "@site/src/components/Shared/kratos/debug/troubleshooting.md"
+
+<MyPartial />
+```
@@ -132,5 +132,5 @@ accessed using a normal browser request by clicking a link or redirecting the en
 
 ## Further reading
 
-Read [this document](../kratos/debug/csrf.mdx) for CRSF troubleshooting specific to self-hosted Ory Kratos Identity Server
-instances.
+Read <SameDeploymentLink to="kratos/debug/csrf" network="oel/kratos/debug/csrf">this document</SameDeploymentLink> for CRSF
+troubleshooting specific to self-hosted Ory Kratos Identity Server instances.
@@ -119,7 +119,7 @@ const oelSidebar = [
                 items: [
                   {
                     type: "autogenerated",
-                    dirName: "kratos/debug",
+                    dirName: "oel/kratos/debug",
                   },
                 ],
               },

@@ -102,7 +102,7 @@ const ossSidebar = [
                 items: [
                   {
                     type: "autogenerated",
-                    dirName: "kratos/debug",
+                    dirName: "oss/kratos/debug",
                   },
                 ],
               },

@@ -0,0 +1,57 @@
+import useBaseUrl from "@docusaurus/useBaseUrl"
+import CodeFromRemote from "@site/src/theme/CodeFromRemote"
+
+For general CRSF troubleshooting visit the
+[CSRF troubleshooting](/docs/troubleshooting/csrf).
+
+This document contains troubleshooting advice regarding CRSF and cookie errors
+specific to self-hosted Ory Identities Kratos.
+
+## Common issues
+
+### SameSite attribute
+
+If you run Ory Kratos in `--dev` mode, it disables `SameSite=Lax` as Google
+Chrome rejects all cookies that have `SameSite=Lax` but have `secure` set to
+`false`. If you require `SameSite=Lax`, you need to run Ory Kratos with HTTPS
+and not use the `--dev` flag.
+
+### Running over HTTP without `--dev` mode
+
+Ory Kratos' cookies have the `Secure` flag enabled by default. This means that
+the browser won't send the cookie unless the URL is a HTTPS URL. If you want Ory
+Kratos to work with HTTP (for example on localhost) you can add the `--dev`
+flag: `kratos serve --dev`.
+
+**Don't do this in production!**
+
+### Running on separate (sub)domains
+
+Cookies work best on the same domain. While it's possible to get cookies running
+on subdomains it isn't possible to do that across Top Level Domains (TLDs).
+
+Make sure that your application (for example the Quickstart self service app )
+and Ory Kratos Public API are available on the same domain - preferably without
+subdomains. Hosting both systems and routing paths with a Reverse Proxy such as
+Nginx or Envoy or AWS API Gateway is the best solution. For example, routing
+`https://my-website/kratos/...` to Ory Kratos and `https://my-website/dashboard`
+to the SecureApp's Dashboard. Alternatively you can use piping in your app as we
+do in the Quickstart guide.
+
+We don't recommend running them on separate subdomains, such as
+`https://kratos.my-website/` and `https://secureapp.my-website/`.
+
+To allow cookies to work across subdomains, make sure to set the domain name in
+the Kratos config file under
+[`session.cookie.domain`](https://www.ory.com/kratos/docs/next/guides/configuring-cookies/#session-cookies).
+
+Running the apps on different domains won't work at all, such as
+`https://kratos-my-website/` and `https://secureapp-my-website/`.
+
+Running the services on different ports is ok, if the domain stays the same.
+
+### Mixing up 127.0.0.1 and localhost
+
+Make sure that the domain stays the same. This is also true for `127.0.0.1` and
+`localhost` which are both separate domains. Make sure that you use `127.0.0.1`
+or `localhost` consistently across your configuration!