mblackgeo / flask-cognito-lib

A Flask extension that supports protecting routes with AWS Cognito following OAuth 2.1 best practices
https://mblackgeo.github.io/flask-cognito-lib/
MIT License
57 stars 15 forks source link

flask_cognito_lib.exceptions.CognitoError: Cognito error : invalid_grant #33

Closed StevenMapes closed 9 months ago

StevenMapes commented 9 months ago

This is more a question than a bug, but I've been playing with this project and whilst it works for me locally when I try using it with a project that is setup behind a Elastic Load Balancer (ALB) I find that when I am redirected back to /postlogin I receive a HTTP 504 gateway timeout. Looking in the syslog I can find the following error:

flask_cognito_lib.exceptions.CognitoError: Cognito error : invalid_grant

With the following traceback

Traceback (most recent call last):
File "/home/redacted/venv/lib/python3.10/site-packages/flask/app.py", line 1455, in wsgi_app
    response = self.full_dispatch_request()
File "/home/redacted/venv/lib/python3.10/site-packages/flask/app.py", line 869, in full_dispatch_request
    rv = self.handle_user_exception(e)
File "/home/redacted/venv/lib/python3.10/site-packages/flask/app.py", line 867, in full_dispatch_request
    rv = self.dispatch_request()
File "/home/redacted/venv/lib/python3.10/site-packages/flask/app.py", line 852, in dispatch_request
    return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
File "/home/redacted/venv/lib/python3.10/site-packages/flask_cognito_lib/decorators.py", line 88, in wrapper
    tokens = cognito_auth.get_tokens(
File "/home/redacted/venv/lib/python3.10/site-packages/flask_cognito_lib/plugin.py", line 117, in get_tokens
    return self.cognito_service.exchange_code_for_token(
File "/home/redacted/venv/lib/python3.10/site-packages/flask_cognito_lib/services/cognito_svc.py", line 119, in exchange_code_for_token
    raise CognitoError(f"Cognito error : {response_json['error']}")
flask_cognito_lib.exceptions.CognitoError: Cognito error : invalid_grant

I was wondering if you've managed to get it working behind an ELB before?

StevenMapes commented 9 months ago

Issues was down to IPv6 routing tables not pointing to the gateway