Widen / cloudfront-auth

An AWS CloudFront Lambda@Edge function to authenticate requests using Google Apps, Microsoft, Auth0, OKTA, and GitHub login
ISC License
626 stars 149 forks source link

Redirect Loop Error #87

Open lightmagic1 opened 3 years ago

lightmagic1 commented 3 years ago

Issue

I'm have the following error after used the "Login with google" in Auth0.

Error

Configs

Lambda

{
    "AUTH_REQUEST": {
        "client_id": "<myId>",
        "response_type": "code",
        "scope": "openid email",
        "redirect_uri": "https://<myCF>.cloudfront.net"
    },
    "TOKEN_REQUEST": {
        "client_id": "<myId>",
        "client_secret": "<myRandomGeneratedSecret>",
        "redirect_uri": "https://<myCF>.cloudfront.net",
        "grant_type": "authorization_code"
    },
    "DISTRIBUTION": "serverlessAuth",
    "AUTHN": "AUTH0",
    "PRIVATE_KEY": "<KEY>",
    "PUBLIC_KEY": "<KEY>",
    "DISCOVERY_DOCUMENT": "https://<myAuth0>.auth0.com/.well-known/openid-configuration",
    "SESSION_DURATION": 259200,
    "BASE_URL": "https://<myAuth0>.us.auth0.com",
    "CALLBACK_PATH": "/_callback",
    "AUTHZ": "AUTH0"
}

CloudFront Config

cf

Auth0 Config

Only social connection with google Enabled:

cnf

Seems to be working fine, testing inside auth0 connection test:

gcnf

My Auth0 Config:

cnf

Additional Info:

My Cloudfront redirects to a S3 bucket with static files (docusaurus generated).

FF Tools:

My requests keeps in a infinity loop 'till error:

error

Can someone help me? What i'm doing wrong?

ajrice6713 commented 3 years ago

@lightmagic1 did you ever get this resolved - I am having the same redirect loop issue (also hosting a static docusaurus site, using okta as my oidc provider) and would love to be able to figure this out

jayeshbino commented 3 years ago

@lightmagic1 @ajrice6713 Can you try adding /_callback to your redirect URI which I believe should fix the issue.

For Eg. https://mydomain.cloudfront.net/_callback

ajrice6713 commented 3 years ago

@jayeshbino my issue ended up being the lambda@edge invoked on the origin request as opposed the viewer request