Amazon Cognito: How to stop getting "redirect_mismatch" error when redirecting from browser to Android app

Question

I am trying to create a Android project where I authorize a user by having him log into Amazon Cognito in a browser, which should then redirect back to my app. Unfortunately, when the browser opens, instead of reaching the proper sign-in page, I keep getting this error:

In my AuthenticatorActivity.java:

@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_authenticator);

    Uri authzUrl = Uri.parse("https://<myDomain>.auth.us-west-2.amazoncognito.com/login?response_type=token&client_id=<myClientId>&redirect_uri=myapp://mainAct");
    Intent launchBrowser = new Intent(Intent.ACTION_VIEW, authzUrl);
    startActivity(launchBrowser);
}

In AndroidManifest:

<activity android:name=".MainActivity">
    <intent-filter>
        <action android:name="android.intent.action.VIEW" />
        <category android:name="android.intent.category.DEFAULT" />
        <category android:name="android.intent.category.BROWSABLE" />
        <data android:host="mainAct" android:scheme="myapp"></data>
    </intent-filter>
</activity>

I can't figure out what I am doing wrong here. Am I missing a step?

Capping

Did you ever solve this? – Blackmun

I got this to work after setting my Callback URL(s) [you can define more than one which is why you need to specify the redirect_uri] and defining my Login Endpoint. <br />Go to the Amazon Cognito Developer Guide where they define the spec's for the Login Endpoint: https://docs.aws.amazon.com/cognito/latest/developerguide/login-endpoint.html <br />At the bottom of the page they give an example. This page describes which parameters are required and which are optional. – Syllabize

Answer 1

Ok, I'm leaving a tidbit here for whoever might find it next. I hit this issue exact same issue, but as a newbie to Cognito and IdP/SSO I had no idea how to fix this. Here is what I did to eventually fix this. We were integrating with an external service, and we were getting this error. Under Chrome Developer Tools -> Network, I started to record the URL's visited, then I tried the SSO integration again. There was a URL that showed up in the list which visited Cognito with a redirect to URL. That URL must be the same URL as listed under the Callback URL for Cognito.

Hopefully, this saves someone some time in the future.

Trifocal

In short... the redirect_uri parameter in the request to the Cognito endpoint needs to match the "Callback URL" found in the Cognito user pool's App client settings. – Matland

I was also struggling with this. I had the root set correctly but forgot to set the path. So I had https://192.168.0.101;3000/ but should have been https://192.168.0.101;3000/userProfile – Anadiplosis

I just came here to say that I had "localhost:3000" (trailing slash) in my oauth config and "localhost:3000" (no trailing slash) in my Cognito User Pool callback URL ... when I made them both have the trailing slash, this error went away. – Doubleteam

For me the redirect url defined on aws was only "myapp://". After I changed it to "myapp://appname", it worked. But thanks for the developer tools trick. It helped me find the issue on which i was stuck from 3 days. – Freeholder

Can you write example because when I am writing redirect url as "myapp://Hello World" where Hello World is my app name its not working. – Distant

Answer 2

Do check your callback url and sign out url. The corect format is :

app_client_name:https://www.myapp.com/

Gilbertina

so in your case the app_client_name would be alok-besure? – Astronomer

Thank you. Specifying a full URL in Callback URL and Sign out URL worked for me. – Roosevelt

Answer 3

redirect_uri (1st img) must be the same as in the Callback URL(s) field (2nd img).

1st img

2nd img (App integration -> App client settings under AWS)

Doralyn

Answer 4

Extending on the answer by Dimitris https://mcmap.net/q/298957/-amazon-cognito-how-to-stop-getting-quot-redirect_mismatch-quot-error-when-redirecting-from-browser-to-android-app

If you have a DNS route53 specified for your load balancer. You can specify the same in the callback URL.

https://www.example.com/oauth2/idpresponse

Ref: https://aws.amazon.com/premiumsupport/knowledge-center/elb-configure-alb-authentication-idp/

Shrike

Answer 5

Another silly mistake I did and took me hours to figure it out was the fact that the value of redirectSignIn in aws-exports.js was completely wrong. When you modify the value of this configuration multiple times through Amplify CLI, it appends a comma treating the value as a List giving you something like this

 "redirectSignIn": "http://localhost:3000/,http://localhost:3000/,http://localhost:3000/,http://localhost:3000/",

Unfortunately, the value is treated as a string when used using HostedUI.

Pale

Wow you saved me so much time. Thank you! – Wall

@Oscar, I am working with amplify too, to integrate SAML based IDP. However if I go access the url directly: https://<pooldomain>.amazoncognito.com/login?response_type=token&client_id=<myClientID>&redirect_uri=localhost:3000/campaignsList, it works greats. However, I need to integrate it to the front end as well. But I am facing issues. My aws-export.js has oauth as: – Klecka

"oauth": { "domain": <MyPoolDomain>,"scope":["phone","email","openid","profile","aws.cognito.signin.user.admin"],"redirectSignIn": "localhost:3000/campaignsList", "redirectSignOut": "localhost:3000/signin", "responseType": "token", "client_id": <Client id> }, I have kept redirectSignIn equal to the CallBackUrls in my cognito client and redirectSignOut equal to the Sign out URLs. Also, on the sign in page I do: Auth.configure({ awsmobile }); to pick up the configurations and on signin button click I do: – Klecka

await Auth.federatedSignIn({customProvider: "IdP"}). – Klecka

@AzherAleem what issue are you facing? – Pale

@OscarNevarez, I have everything resolved, however, when I click my sign out button which calls the Aut.SignOut() function of amplify but it doesn't work out as the url is: undefined/…. As you can see the domain is displaying as undefined. – Klecka

Answer 6

An answer not covered here(probably due to docs being updated recently) is about logout_uri. If you are setting your logout URL to a URL different from your log in URL, you will get redirect mismatch error with redirect_uri parameter.

For e.g.

Log in URL: http://localhost:3000/log_in.html
Call back URL(after login): http://localhost:3000/logged_in.html
Sign out URL(after logout): http://localhost:3000/logged_out.html

I was sending request using redirect_uri parameter to a custom sign out URL page like this

https://xxx.auth.ap-southeast-1.amazoncognito.com/logout?client_id=xxx&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Flogged_out.html

which resulted in redirect mismatch error.

I had to change to logout_uri to make it work.

https://xxx.auth.ap-southeast-1.amazoncognito.com/logout?client_id=xxx&response_type=code&logout_uri=http%3A%2F%2Flocalhost%3A3000%2Flogged_out.html

PS: Make sure that your redirect_uri or logout_uri is same in AWS Cognito console and your code otherwise it will result in redirect mismatch error.

Documentation: https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.html#get-logout

Stilla

Very important piece of information! My issue was exactly about logout_uri. – Gilmagilman

Answer 7

I am using amplify with cognito and encountered this error. Fixed by following. In aws-export.ts, there is a redirectSingIn url, it must be the exact same url as in cognito/app Integration/app client setting/ callback url which is where the application runs.

Update: I encountered this problem again in AWS cognito, user pool, App client, client web. After updating the Callback URL(s), things starts to break, even the Callback URL(s) is valid. Later I figured out that it will take some time for the change to sync in. Need to walk away about 10 minutes, then try again.

Steer

Answer 8

I solved this by remembering to include http:// in the callbackUrl on the frontend.

const redirect_url=`${window.location.origin}`;

It probably wont be a common reason, but was why mine broke.

Highams

Answer 9

This is because of the mismatched url for either redirectSignIn or redirectSignOut. Please check both setup in aws console and code aws_config, and make them consistent.

aws console redirect uri configuration

Enolaenormity

Answer 10

In my case the error was due to CloudFront serving the old files.

To solve it; you can invalidate CloudFront files via AWS console. p.s. can use /* to invalidate all of the files https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Invalidation.html

Novia

Answer 11

You absolutely need to make sure these items are checked if you're requesting a scope, otherwise you get redirect_mismatch (unhelpful error name).

With a config of below from the tutorial here

Auth.configure({
  oauth: {
    domain: aws.idpDomain,
    scope: ['email', 'openid'],
    // we need the /autologin step in between to set the cookies properly,
    // we don't need that when signing out though
    redirectSignIn: aws.redirectSignIn,
    redirectSignOut: aws.redirectSignOut,
    responseType: 'token',
  },
})

Kleper

It also works fine with Allowed OAuth Flows set to Authorization code grant instead of Implicit grant. – Roosevelt

Answer 12

In my case is was because in the console I was redirecting to https://localhost:4200 but in the URL I had http://localhost:4200. Note the SSL/TLS version vs. non-SSL/TLS

Inebriant

Answer 13

In the context of Amplify + multiple redirection URLs (inspired by @Oscar Nevarez) I looked at src/aws-export.js :

        "redirectSignIn": "https://example.com/,http://localhost:5173/",
        "redirectSignOut": "https://example.com/,http://localhost:5173/",

Which is NOT digested by Cognito when passed as URL redirect_uri parameter.

My fix was to override these values in src/main.js as follows

awsconfig.oauth.redirectSignIn = `${window.location.origin}/`
awsconfig.oauth.redirectSignOut = `${window.location.origin}/`

Worked both for local and deployed

Brigade

Answer 14

It's important to say that every time that you change some on your cognito app client the sso url for display the login screen on the IDP also changes, so keep that in mind to update that url where ever you're storing. In my case that was the problem

Byrdie

Answer 15

Assuming your website is behind an application load balancer (ALB), and you have a listener rule that uses a Cognito user pool and Path is * in the IF rule statement, you should configure your 0Auth client app callback url, like:

https://<your-ALB-DNS>/oauth2/idpresponse

This make it work for me at least, with no other fancy config.

Keep in mind though that this will just provide a layer on top of whatever you have behind the ALB. If you have some additional authentication method in it, you have to configure that as well.

Atahualpa

Answer 16

1. For me, make sure that you http://localhost:8000/accounts/amazon-cognito/login/callback/ and not http://127.0.0.1:8000/.... Because, 127.0.0.1 and localhost are technically different when it comes to URI redirects. Use localhost.
2. Check OpenID Connect scopes as email, openid, profile in case of scope error

Wavelength

Answer 17

I followed this video "Adding Facebook Sign In for Web Applications with AWS Amplify": https://dev.to/aws/adding-facebook-sign-in-for-web-applications-with-aws-amplify-2fc8

It deploys to localhost, so I then deployed it to a Amplify URL ... I had the same redirect error ad it turned out that I hadn't updated aws-exports.js in the src directory.

Arielle