Why is AWS Elastic Beanstalk not passing the custom JWT?

Question

I have successfully deployed a Next.js with Next-Auth project on AWS EB. Everything looks fine. However, I can't get passed the sign in form.

Here's what the browser console shows:

502 Bad Gateway: POST http://----.elasticbeanstalk.com/api/auth/callback/credentials? Uncaught (in promise) SyntaxError: JSON.parse: unexpected character at line 1 column 1 of the JSON data

Here's what the EB logs show:

upstream sent too big header while reading response header from upstream, client: x.x.x.x, server: , request: "POST /api/auth/callback/credentials? HTTP/1.1", upstream: "http://-----/api/auth/callback/credentials?", host: "----", referrer: "http://----.elasticbeanstalk.com/"

I've also shoved some console logs in [...nextauth].tsx file to find the issue.

The console logs show fine all through the Providers.Credentials.
The console logs show fine all through the jwt callbacks.
But the console logs never appear in the session callback.

So it dies somewhere between jwt and session callback.

Here's the config that I have under .ebextensions/

.ebextensions/proxy_custom.config:

files:
  "/etc/nginx/conf.d/proxy_custom.conf":
    mode: "000644"
    owner: root
    group: root
    content: |
      proxy_buffer_size   128k;
      proxy_buffers   4 256k;
      proxy_busy_buffers_size   256k;

container_commands:
  01_reload_nginx:
    command: "sudo service nginx reload"

You may need to adjust your nginx settings to increase buffer size. Do you mind posting your current config from `.ebextensions` folder? — PsyGik, Aug 23 '21 at 18:11

score 1 · Answer 1 · answered Aug 24 '21 at 07:01

Here is an updated config (based on what I've used), you may want to try them individually to see which config works best for you.

files:
  "/etc/nginx/conf.d/proxy_custom.conf":
    mode: "000644"
    owner: root
    group: root
    content: |
      large_client_header_buffers 4 32k;
      fastcgi_buffers 16 32k;
      fastcgi_buffer_size 32k;
      proxy_buffer_size   128k;
      proxy_buffers   4 256k;
      proxy_busy_buffers_size   256k;

container_commands:
  01_reload_nginx:
    command: "sudo service nginx reload"

make sure to check what the actual header sizes of your requests are and adjust the sizes accordingly. curl -s -w \%{size_header} -o /dev/null https://example.com by replacing example.com with your service url and add request headers via -H, if needed. This will give you the header size in bytes.

don't set those buffers too high and use calculations specific to your app. Arbitrarily high values won't do good to your RAM, because those buffers are used per connection.

Reference: https://www.getpagespeed.com/server-setup/nginx/tuning-proxy_buffer_size-in-nginx

Thank you! The information was useful. Any apps that are under Amazon Linux 2 need to add the configs to the `.platform` folder instead of the `.ebextensions` folder. — thetaPC, Aug 25 '21 at 16:54

score 0 · Accepted Answer · answered Aug 25 '21 at 16:52

The issue was caused by a cookie being too large to set.

The .ebextensions was never being applied. This is due to the app being under Amazon Linux 2. The configs need to go under .platform for Amazon Linux 2.

These are the lines that did it:

proxy_buffer_size   128k;
proxy_busy_buffers_size   256k;
proxy_buffers   4 256k;

This answer from another post helped narrow down the issue.

Why is AWS Elastic Beanstalk not passing the custom JWT?

2 Answers2