here's the error in browser console

CORS setup in my Http Api Gateway

SuperTokens init setup in backend

export const getBackendConfig = () => {
  return {
    framework, // awsLambda
    supertokens: {
      connectionURI: supertokensUri,
      apiKey: supertokensApiKey,
    },
    appInfo: {
      appName,
      apiDomain, // https://rfid1dfw6i.execute-api.us-east-1.amazonaws.com
      websiteDomain, // https://d1l44yiy5f0ck4.cloudfront.net
      apiBasePath: '/auth',
    },
    recipeList: [
      Dashboard.init({
        apiKey: supertokensApiKey,
      }),
      ThirdParty.init({
        signInAndUpFeature: {
          providers: [
            {
              id: 'O365',
              get: (redirectURI, authCodeFromRequest) => {...} // extracted for character limit
            },
          ],
        },
      }),
      Session.init({
        jwt: {
          enable: true,
        },
        // TODO conditionally set this, might have prod with same domain base
        // between website domain and api domain
        getTokenTransferMethod: () => 'header',
        cookieDomain: '.amazonaws.com',
        override: {
          functions: function (originalImplementation) {
            return {
              ...originalImplementation,
              createNewSession: async function (input) {
                input.accessTokenPayload = {
                  ...input.accessTokenPayload,
                  aud: azureAdClientId, // client id registered in Azure AD
                }

                return originalImplementation.createNewSession(input)
              },
            }
          },
        },
      }),
    ],
    isInServerlessEnv: true,
  }
}

also, here is my handler for the auth endpoints lambda:

exports.handler = middy(middleware())
  .use(
    cors({
      origin: getBackendConfig().appInfo.websiteDomain,
      credentials: true,
      headers: ['Content-Type', ...supertokens.getAllCORSHeaders()].join(', '),
      methods: 'OPTIONS,POST,GET,PUT,DELETE',
    })
  )
  .onError((request) => {
    console.log(JSON.stringify(request))
    throw request.error
  })

ok @nkshah2 i found some information saying that in AWS if you apply CORS settings at the Api Gateway level for http api, it overrides. the headers and our supertokens headers are lost. the recommendation is to not set CORS settings on the gateway, and then just handle setting CORS headers directly in your lambda and explicitly set up an OPTIONS handler for that. That got me past that 204 issue on the OPTIONS call. Now I'm able to get the third party authorization url, redirect to the id provider, authenticate successfully, then get redirected to my callback. BUT, it's still not able to find an active session even after that, and it keeps calling /auth/session/refresh which is giving me a 401 unauthorized... Is this a common issue when hosting a frontend in Cloudfront via an S3 bucket static spa app?

I have it configured to use header based auth since my frontend and backend are on different domains, but the Authorization header doesn’t seem to be getting passed in for the session refresh call or hitting my api

whats the request header as seen on the chrome's network tab when the refresh API is called?

so this doesn't have the authorization bearer token in it. What are the cookies stored on the frontend before this call is made?

I’m still not seeing any cookies for the site

Perhaps @porcellus can help here

this is really strange 🙂

could you enable debug logs on the frontend (

enableDebugLogs: true,

in ST init), go through the login again and post the logs?

there'll be a ton of logs, so I'd prefer it in text form (you can right click the debugger console and save the entire thing into a file I think)

attaching now

when you open the site is there an

st-last-access-token-update

cookie?

did you maybe open the site in incognito?

if it was an issue with the frontend being hosted in an S3 bucket exposed via Cloudfront that's causing the Authorization header not to be sent, would we still see the debug logs trying to send that header?

I didn't want to buy domains for this since this is just a proof of concept I'm trying to stand up in a sandbox environment in order to propose this to my team as a better option than the current Cognito setup we have

so if I can get this working and the team likes it we'd integrate it with our own domain and I think we have VPC's and such as well

if we eventually integrate this and migrate to our own domains, would I need to add that back into the frontend config?

I'm still getting cors errors from frontend to my api, but it looks similar to what I've resolved with getting my /auth endpoints to work so I'm hoping I can work that piece out

have you seen issues with using jwt authorizers in AWS?

I've got my api using jwt authorizers and am getting this error

when I check out the token, I see that it's a SuperTokens token that includes jwt in it, and then when I check out the contained jwt, that one has the kid value that the jwt authorizer is looking for. Do you know how I can get that fixed?

ok, that resolved jwt authorizer issue but I still just can't seem to get a successful response from my api. Have worked through so many issues hopefully this is the last one, and it seems like this might be AWS specific. the lambda at my api endpoint is getting hit and returning the data I'm expecting, but for some reason at the API Gateway level it's giving me an error 500 and not sending back my results to the frontend. any idea on this one?

And it’s an Http Api Gateway which apparently provides fewer logs than a Rest Api but I was struggling to get the Rest Api to work before

is the response 500? Or 502?

cause a 502 usually means that the response header length is too long and that can be fixed with some config on the gateway

I might have to try switching back to a Rest Api at some point and give that another shot. I was having issues getting the lambda authorizer to work which is why I switched to Http but thinking I can hopefully have a better chance with that option

Apparently the Rest api supports more logging capabilities that would help troubleshoot the lambda 200 —> gateway 500 issue