Context
Cognito redirects a signed-in browser to an allowed application callback. In an authorization-code flow, the application later exchanges the code for tokens. A redirect mismatch can happen at either boundary. Trace the exact URI used at each stage before changing the app-client allowlist or application route.
Prepare a safe sign-in trace
Record the user pool, app client ID, domain, environment, callback allowlist and application framework configuration. Capture the authorization request's non-sensitive URL parameters and the token request's redirect parameter through controlled debugging. Do not copy authorization codes, tokens, cookies or client secrets into incident notes.
Identify any load balancer or reverse proxy that changes the apparent scheme or host. A callback generated from an internal HTTP request can differ from the browser's public HTTPS URL even when the application's configured route name looks correct.
1. Compare the registered and requested callback
Inspect the exact app client used by the authorization request. Compare its allowed callback URL with the request's redirect_uri, including scheme, hostname, port and path. Check trailing slashes and environment-specific hostnames rather than visually comparing only the domain.
AWS requires an absolute, pre-registered callback without a fragment. HTTPS is required except for the documented localhost testing case, and supported application schemes have their own use. Keep development and production callback decisions intentional instead of adding broad redirect destinations during troubleshooting.
2. Trace callback construction behind proxies
Review the framework's trusted-proxy settings and public base URL. Verify which request headers are trusted and whether the generated callback represents the external origin. Correct the application configuration or approved proxy trust boundary; do not trust arbitrary forwarded host values from every source.
Check multiple application instances for configuration drift. One node generating a different callback can make failures appear intermittent. Compare release identifiers and effective non-secret callback configuration across the active deployment.
3. Verify the token exchange matches
| Evidence | Likely boundary | Next check |
|---|---|---|
| Failure before application callback | Authorization request not allowed | Registered callback and app client |
| Callback receives code, token exchange fails | Redirect or grant mismatch | Token request parameters |
| Only one environment fails | Public URL configuration differs | Scheme, host and path |
| Failures vary by instance | Deployment configuration drift | Effective callback configuration |
An explicitly illustrative scenario: a preview environment receives browser traffic over HTTPS, but its application server sees HTTP behind the load balancer. The framework generates an HTTP callback that is absent from the Cognito registration. The team configures the reviewed external URL and proxy settings, then verifies that both authorization and token exchange use the same HTTPS callback. Adding the internal HTTP URL to production registration would preserve the wrong public-origin model.
Correct and test the complete session
Change the smallest responsible configuration in a test environment. Start a fresh sign-in with a new authorization code; reusing a consumed code produces a separate failure. Confirm callback handling, token exchange, session creation and the application's intended post-login destination.
Test sign-out separately because sign-out URLs are distinct app-client settings. Verify failure behavior for an unregistered callback using a controlled test rather than accepting arbitrary redirects.
The SOP should assign ownership for app-client registration, public URL configuration, proxy trust and environment creation. Monitor authentication errors without storing token-bearing URLs. Recheck the complete flow after domain changes, proxy migrations and framework upgrades so callback consistency remains part of release acceptance.
Explore Clouvenix cloud security for implementation and operational handover.
Technical reference
App-client callback settings, authorization endpoint, and token endpoint document redirect requirements.