Error code 400 after deployment in aws and after login from blazor ui #9496

3 Answer(s)

• 

  0

  AI-Bot created 21 days ago

  Support Team ABP Agent

  When you encounter an HTTP 400 error after authentication in an ABP microservice solution (Blazor Server UI) deployed on AWS, the most common causes are related to misconfiguration of redirect URIs, cookie settings, or OpenIddict client registration.

  Here are the steps to resolve this issue:

  1. Check Redirect URIs in OpenIddict Application Registration

     • Ensure that the RedirectUri and PostLogoutRedirectUri for your BlazorServer client in the OpenIddict application registration exactly match the URLs used by your Blazor Server app:
       • https://app.dreamlist.gr/signin-oidc
       • https://app.dreamlist.gr/signout-callback-oidc
     • These must be set both in your OpenIddict data seed and in the AuthServer's database.

  2. Verify AppSettings Configuration

     • In your Blazor Server app's appsettings.json, confirm:

       "AuthServer": {
         "Authority": "https://auth.dreamlist.gr",
         "RequireHttpsMetadata": true,
         "ClientId": "BlazorServer",
         "ClientSecret": "1q2w3e*"
       }
       "App": {
         "SelfUrl": "https://app.dreamlist.gr"
       }
       

     • The SelfUrl must match the actual public URL of your Blazor Server app.

  3. Check Cookie and SameSite Settings

     • In cloud environments, especially with multiple subdomains, you must ensure cookies are set with the correct domain and SameSite policy. In your Blazor Server app, configure cookies as follows:

       Configure<CookiePolicyOptions>(options =>
       {
           options.MinimumSameSitePolicy = SameSiteMode.Lax;
       });
       

     • If you are using multiple subdomains, set the cookie domain explicitly:

       services.ConfigureApplicationCookie(options =>
       {
           options.Cookie.Domain = ".dreamlist.gr";
           options.Cookie.SameSite = SameSiteMode.Lax;
       });
       

  4. Check for Valid Redirect URI in AuthServer Logs

     • A 400 error after login often means the redirect URI sent by the client does not match any registered URI in the AuthServer. Check the AuthServer logs for errors related to invalid or unregistered redirect URIs.

  5. Check for Proxy or Load Balancer Headers

     • If you are behind a load balancer or reverse proxy (common in AWS), ensure forwarded headers are configured so the app knows the correct external URL:

       app.UseForwardedHeaders(new ForwardedHeadersOptions
       {
           ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
       });
       

     • Also, set ASPNETCORE_FORWARDEDHEADERS_ENABLED=true in your environment variables.

  6. Clear Browser Cookies and Test Again

     • Old or invalid cookies can cause 400 errors. Clear cookies for your domain and try again.

  7. Check for HTTPS Everywhere

     • All URLs (app, auth, gateway) must use HTTPS. Mixed content or HTTP redirects can cause authentication failures.

  If you follow these steps and ensure all URLs and settings are consistent, the 400 error after login should be resolved.

  No verified source available for this specific query.

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Save Cancel
• 

  0

  mgcode created 21 days ago

  I have checked all the possible problems above and I can't fix it. When I click on the login option from the Blazor UI, I noticed that the redirect URL is in http and it is forwarded to https.

  Also the openid config json file is { "issuer": "https://auth.dreamlist.gr/", "authorization_endpoint": "http://auth.dreamlist.gr/connect/authorize", "token_endpoint": "http://auth.dreamlist.gr/connect/token", "introspection_endpoint": "http://auth.dreamlist.gr/connect/introspect", "end_session_endpoint": "http://auth.dreamlist.gr/connect/endsession", "revocation_endpoint": "http://auth.dreamlist.gr/connect/revocat", "userinfo_endpoint": "http://auth.dreamlist.gr/connect/userinfo", "device_authorization_endpoint": "http://auth.dreamlist.gr/device", "jwks_uri": "http://auth.dreamlist.gr/.well-known/jwks", "grant_types_supported": [ "authorization_code", "implicit", "password", "client_credentials", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code", "LinkLogin", "Impersonation" ], "response_types_supported": [ "code", "code id_token", "code id_token token", "code token", "id_token", "id_token token", "token", "none" ], "response_modes_supported": [ "query", "form_post", "fragment" ], "scopes_supported": [ "openid", "offline_access", "email", "profile", "phone", "roles", "address", "AuthServer", "IdentityService", "AdministrationService", "CrmService", "SaasService", "AuditLoggingService", "GdprService", "FileManagementService", "LanguageService", "ChatService" ], "claims_supported": [ "aud", "exp", "iat", "iss", "sub" ], "id_token_signing_alg_values_supported": [ "RS256" ], "code_challenge_methods_supported": [ "plain", "S256" ], "subject_types_supported": [ "public" ], "prompt_values_supported": [ "consent", "login", "none", "select_account" ], "token_endpoint_auth_methods_supported": [ "client_secret_post", "private_key_jwt", "client_secret_basic" ], "introspection_endpoint_auth_methods_supported": [ "client_secret_post", "private_key_jwt", "client_secret_basic" ], "revocation_endpoint_auth_methods_supported": [ "client_secret_post", "private_key_jwt", "client_secret_basic" ], "device_authorization_endpoint_auth_methods_supported": [ "client_secret_post", "private_key_jwt", "client_secret_basic" ], "claims_parameter_supported": false, "request_parameter_supported": false, "request_uri_parameter_supported": false, "tls_client_certificate_bound_access_tokens": false, "authorization_response_iss_parameter_supported": true }

  I have checked all the appsettings and everything is in https. I've searched for the problem and it seems like everything is set up correctly on https. I don't know what else to look for to find what's wrong.

  Save Cancel
• 

  0

  mgcode created 20 days ago

  Hello,

  I managed to solve the problem by adding this code to auth server to run in https.

          if (!env.IsDevelopment())
          {
              app.Use((ctx, next) =>
              {
                  /* This application should act like it is always called as HTTPS.
                   * Because it will work in a HTTPS url in production,
                   * but the HTTPS is stripped out in Ingress controller.
                   */
                  ctx.Request.Scheme = "https";
                  return next();
              });
          }
  

  Also i change the health checks code in all services and apps to this.

  settings.AddHealthCheckEndpoint("AuthServer Health Status", $"http://{Dns.GetHostName()}{healthCheckUrl}");

  Save Cancel