Amazon Cognito: How to stop getting "redirect_mismatch" error when redirecting from browser to Android app

Question

I am trying to create a Android project where I authorize a user by having him log into Amazon Cognito in a browser, which should then redirect back to my app. Unfortunately, when the browser opens, instead of reaching the proper sign-in page, I keep getting this error:

In my AuthenticatorActivity.java:

@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_authenticator);

    Uri authzUrl = Uri.parse("https://<myDomain>.auth.us-west-2.amazoncognito.com/login?response_type=token&client_id=<myClientId>&redirect_uri=myapp://mainAct");
    Intent launchBrowser = new Intent(Intent.ACTION_VIEW, authzUrl);
    startActivity(launchBrowser);
}

In AndroidManifest:

<activity android:name=".MainActivity">
    <intent-filter>
        <action android:name="android.intent.action.VIEW" />
        <category android:name="android.intent.category.DEFAULT" />
        <category android:name="android.intent.category.BROWSABLE" />
        <data android:host="mainAct" android:scheme="myapp"></data>
    </intent-filter>
</activity>

I can't figure out what I am doing wrong here. Am I missing a step?

I got this to work after setting my Callback URL(s) [you can define more than one which is why you need to specify the redirect_uri] and defining my Login Endpoint.
Go to the Amazon Cognito Developer Guide where they define the spec's for the Login Endpoint: [https://docs.aws.amazon.com/cognito/latest/developerguide/login-endpoint.html](https://docs.aws.amazon.com/cognito/latest/developerguide/login-endpoint.html)
At the bottom of the page they give an example. This page describes which parameters are required and which are optional. — Valen, Aug 29 '19 at 18:23

score 60 · Accepted Answer · answered Dec 03 '18 at 22:24

60

Ok, I'm leaving a tidbit here for whoever might find it next. I hit this issue exact same issue, but as a newbie to Cognito and IdP/SSO I had no idea how to fix this. Here is what I did to eventually fix this. We were integrating with an external service, and we were getting this error. Under Chrome Developer Tools -> Network, I started to record the URL's visited, then I tried the SSO integration again. There was a URL that showed up in the list which visited Cognito with a redirect to URL. That URL must be the same URL as listed under the Callback URL for Cognito.

Hopefully, this saves someone some time in the future.

answered Dec 03 '18 at 22:24

rlasch

859
9
11

34

In short... the `redirect_uri` parameter in the request to the Cognito endpoint needs to match the "Callback URL" found in the Cognito user pool's App client settings. – Lqueryvg Apr 03 '20 at 08:06
1

I was also struggling with this. I had the root set correctly but forgot to set the path. So I had ``https://192.168.0.101;3000/ `` but should have been ``https://192.168.0.101;3000/userProfile`` – HardBurn Aug 13 '20 at 08:31
2

I just came here to say that I had "http://localhost:3000/" (trailing slash) in my oauth config and "http://localhost:3000" (no trailing slash) in my Cognito User Pool callback URL ... when I made them both have the trailing slash, this error went away. – Jason L Nov 09 '21 at 18:03
For me the redirect url defined on aws was only "myapp://". After I changed it to "myapp://appname", it worked. But thanks for the developer tools trick. It helped me find the issue on which i was stuck from 3 days. – Sahil Garg Feb 07 '22 at 11:12
Can you write example because when I am writing redirect url as "myapp://Hello World" where Hello World is my app name its not working. – Nicks Dec 22 '22 at 14:33

score 13 · Answer 2 · edited Aug 01 '19 at 08:36

13

Do check your callback url and sign out url. The corect format is :

app_client_name:https://www.myapp.com/

edited Aug 01 '19 at 08:36

crmpicco

16,605
26
134
210

answered Aug 24 '18 at 06:53

Alok Verma

157
1
5

so in your case the `app_client_name` would be `alok-besure`? – Alex Cory Nov 28 '19 at 05:20
1

Thank you. Specifying a full URL in **Callback URL** and **Sign out URL** worked for me. – John McGehee Nov 13 '20 at 19:41

score 10 · Answer 3 · answered Nov 05 '21 at 11:01

10

redirect_uri (1st img) must be the same as in the Callback URL(s) field (2nd img).

1st img

2nd img (App integration -> App client settings under AWS)

answered Nov 05 '21 at 11:01

Ramis

13,985
7
81
100

score 7 · Answer 4 · answered Sep 24 '20 at 08:32

Extending on the answer by Dimitris https://stackoverflow.com/a/60456018/6883773

If you have a DNS route53 specified for your load balancer. You can specify the same in the callback URL.

https://www.example.com/oauth2/idpresponse

Ref: https://aws.amazon.com/premiumsupport/knowledge-center/elb-configure-alb-authentication-idp/

Feng Zhang · Answer 5 · 2021-02-05T01:35:46.727

I am using amplify with cognito and encountered this error. Fixed by following. In aws-export.ts, there is a redirectSingIn url, it must be the exact same url as in cognito/app Integration/app client setting/ callback url which is where the application runs.

Update: I encountered this problem again in AWS cognito, user pool, App client, client web. After updating the Callback URL(s), things starts to break, even the Callback URL(s) is valid. Later I figured out that it will take some time for the change to sync in. Need to walk away about 10 minutes, then try again.

score 4 · Answer 6 · answered Sep 14 '20 at 20:17

4

Another silly mistake I did and took me hours to figure it out was the fact that the value of redirectSignIn in aws-exports.js was completely wrong. When you modify the value of this configuration multiple times through Amplify CLI, it appends a comma treating the value as a List giving you something like this

 "redirectSignIn": "http://localhost:3000/,http://localhost:3000/,http://localhost:3000/,http://localhost:3000/",

Unfortunately, the value is treated as a string when used using HostedUI.

answered Sep 14 '20 at 20:17

Oscar Nevarez

994
12
24

Wow you saved me so much time. Thank you! – Erik Gaasedelen Dec 13 '20 at 07:12
@Oscar, I am working with amplify too, to integrate SAML based IDP. However if I go access the url directly: https://.amazoncognito.com/login?response_type=token&client_id=&redirect_uri=http://localhost:3000/campaignsList/, it works greats. However, I need to integrate it to the front end as well. But I am facing issues. My aws-export.js has oauth as: – Azher Aleem Aug 04 '21 at 12:30
"oauth": { "domain": ,"scope":["phone","email","openid","profile","aws.cognito.signin.user.admin"],"redirectSignIn": "http://localhost:3000/campaignsList/", "redirectSignOut": "http://localhost:3000/signin/", "responseType": "token", "client_id": }, I have kept redirectSignIn equal to the CallBackUrls in my cognito client and redirectSignOut equal to the Sign out URLs. Also, on the sign in page I do: Auth.configure({ awsmobile }); to pick up the configurations and on signin button click I do: – Azher Aleem Aug 04 '21 at 12:31
await Auth.federatedSignIn({customProvider: "IdP"}). – Azher Aleem Aug 04 '21 at 12:33
@AzherAleem what issue are you facing? – Oscar Nevarez Aug 04 '21 at 17:18
@OscarNevarez, I have everything resolved, however, when I click my sign out button which calls the Aut.SignOut() function of amplify but it doesn't work out as the url is: https://undefined/logout?client_id=&logout_uri=https%3A%2F%2Fdev.d2fyb8ryl1mbpo.amplifyapp.com%2Fsignin%2F. As you can see the domain is displaying as undefined. – Azher Aleem Aug 05 '21 at 15:33

score 3 · Answer 7 · answered Feb 23 '23 at 11:11

An answer not covered here(probably due to docs being updated recently) is about logout_uri. If you are setting your logout URL to a URL different from your log in URL, you will get redirect mismatch error with redirect_uri parameter.

For e.g.

Log in URL: http://localhost:3000/log_in.html
Call back URL(after login): http://localhost:3000/logged_in.html
Sign out URL(after logout): http://localhost:3000/logged_out.html

I was sending request using redirect_uri parameter to a custom sign out URL page like this

https://xxx.auth.ap-southeast-1.amazoncognito.com/logout?client_id=xxx&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Flogged_out.html

which resulted in redirect mismatch error.

I had to change to logout_uri to make it work.

https://xxx.auth.ap-southeast-1.amazoncognito.com/logout?client_id=xxx&response_type=code&logout_uri=http%3A%2F%2Flocalhost%3A3000%2Flogged_out.html

PS: Make sure that your redirect_uri or logout_uri is same in AWS Cognito console and your code otherwise it will result in redirect mismatch error.

Documentation: https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.html#get-logout

mewc · Answer 8 · 2020-09-27T00:49:48.233

2

I solved this by remembering to include http:// in the callbackUrl on the frontend.

const redirect_url=`${window.location.origin}`;

It probably wont be a common reason, but was why mine broke.

edited Sep 27 '20 at 00:49

answered Mar 17 '20 at 04:29

mewc

1,253
1
15
24

score 2 · Answer 9 · answered Aug 07 '20 at 12:49

2

This is because of the mismatched url for either redirectSignIn or redirectSignOut. Please check both setup in aws console and code aws_config, and make them consistent.

aws console redirect uri configuration

answered Aug 07 '20 at 12:49

Zhihong LU

143
1
4

score 1 · Answer 10 · answered Mar 12 '19 at 00:35

In my case the error was due to CloudFront serving the old files.

To solve it; you can invalidate CloudFront files via AWS console. p.s. can use /* to invalidate all of the files https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Invalidation.html

score 1 · Answer 11 · answered Jul 24 '20 at 23:54

You absolutely need to make sure these items are checked if you're requesting a scope, otherwise you get redirect_mismatch (unhelpful error name).

With a config of below from the tutorial here

Auth.configure({
  oauth: {
    domain: aws.idpDomain,
    scope: ['email', 'openid'],
    // we need the /autologin step in between to set the cookies properly,
    // we don't need that when signing out though
    redirectSignIn: aws.redirectSignIn,
    redirectSignOut: aws.redirectSignOut,
    responseType: 'token',
  },
})

It also works fine with **Allowed OAuth Flows** set to **Authorization code grant** instead of **Implicit grant**. — John McGehee, Nov 16 '20 at 20:32

score 1 · Answer 12 · edited Dec 01 '22 at 13:23

1

In my case is was because in the console I was redirecting to https://localhost:4200 but in the URL I had http://localhost:4200. Note the SSL/TLS version vs. non-SSL/TLS

edited Dec 01 '22 at 13:23

M.K

1,464
2
24
46

answered Nov 22 '22 at 10:01

Dave Barrineau

11
3

score 1 · Answer 13 · answered Jan 31 '23 at 04:29

In the context of Amplify + multiple redirection URLs (inspired by @Oscar Nevarez) I looked at src/aws-export.js :

        "redirectSignIn": "https://example.com/,http://localhost:5173/",
        "redirectSignOut": "https://example.com/,http://localhost:5173/",

Which is NOT digested by Cognito when passed as URL redirect_uri parameter.

My fix was to override these values in src/main.js as follows

awsconfig.oauth.redirectSignIn = `${window.location.origin}/`
awsconfig.oauth.redirectSignOut = `${window.location.origin}/`

Worked both for local and deployed

score 0 · Answer 14 · answered Feb 28 '20 at 16:45

Assuming your website is behind an application load balancer (ALB), and you have a listener rule that uses a Cognito user pool and Path is * in the IF rule statement, you should configure your 0Auth client app callback url, like:

https://<your-ALB-DNS>/oauth2/idpresponse

This make it work for me at least, with no other fancy config.

Keep in mind though that this will just provide a layer on top of whatever you have behind the ALB. If you have some additional authentication method in it, you have to configure that as well.

score -2 · Answer 15 · edited Feb 21 '21 at 11:07

-2

I followed this video "Adding Facebook Sign In for Web Applications with AWS Amplify": https://dev.to/aws/adding-facebook-sign-in-for-web-applications-with-aws-amplify-2fc8

It deploys to localhost, so I then deployed it to a Amplify URL ... I had the same redirect error ad it turned out that I hadn't updated aws-exports.js in the src directory.

edited Feb 21 '21 at 11:07

desertnaut

57,590
26
140
166

answered Feb 21 '21 at 08:37

Rob Moores

72
8

Amazon Cognito: How to stop getting "redirect_mismatch" error when redirecting from browser to Android app

15 Answers15

1st img

2nd img (App integration -> App client settings under AWS)

Linked