AWS ALB OAuth to Secure Angular and Springboot api Issue in session management

I deployed my Angular application and Spring Boot application in an AWS ECS container and used an EC2 Application Load Balancer (ALB) to expose the internal application. I secured the application using OAuth2, with an access token that expires in 3599 seconds and a refresh token that expires in 90 days. During the initial login, the application successfully authenticated, and the ALB generated and set the AWSELBAuthSessionCookie in the cookie for every request. However, the AWSELBAuthSessionCookie is regenerated every hour. If there is an idle period of one hour and then an action is triggered in the Angular app, it makes multiple HTTP calls simultaneously. The first request succeeds and the response header contains a set-cookie for the regenerated AWSELBAuthSessionCookie, but the subsequent calls fail and redirect to perform an OIDC login, causing a CORS error and a 302 redirect response. This issue prevents my application from functioning properly. How can I handle this issue?

Below is my ALB Configuration

Resources:
MyALB:
Type: AWS::ElasticLoadBalancingV2::LoadBalancer
Properties:
Scheme: internet-facing
SecurityGroups:
- !Ref ALBSecurityGroup
Subnets:
- !Ref PublicSubnet1
- !Ref PublicSubnet2

AngularTargetGroup:
Type: AWS::ElasticLoadBalancingV2::TargetGroup
Properties:
HealthCheckPath: /
Name: angular-targets
Port: 80
Protocol: HTTP
TargetType: ip
VpcId: !Ref VPC
TargetGroupAttributes:
- Key: stickiness.enabled
Value: true
- Key: stickiness.type
Value: lb_cookie
- Key: stickiness.lb_cookie.duration_seconds
Value: 14400

SpringBootTargetGroup:
Type: AWS::ElasticLoadBalancingV2::TargetGroup
Properties:
HealthCheckPath: /api/health
Name: springboot-targets
Port: 8080
Protocol: HTTP
TargetType: ip
VpcId: !Ref VPC
TargetGroupAttributes:
- Key: stickiness.enabled
Value: true
- Key: stickiness.type
Value: lb_cookie
- Key: stickiness.lb_cookie.duration_seconds
Value: 14400

ALBListener:
Type: AWS::ElasticLoadBalancingV2::Listener
Properties:
DefaultActions:
- Type: authenticate-oidc
AuthenticateOidcConfig:
Issuer: https://your-oidc-provider.com
AuthorizationEndpoint: https://your-oidc-provider.com/authorize
TokenEndpoint: https://your-oidc-provider.com/token
UserInfoEndpoint: https://your-oidc-provider.com/userinfo
ClientId: your-client-id
ClientSecret: '{{resolve:secretsmanager:YourSecretId:SecretString:ClientSecret}}'
SessionCookieName: AWSELBAuthSessionCookie
SessionTimeout: 14400
Scope: openid
OnUnauthenticatedRequest: authenticate
- Type: forward
TargetGroupArn: !Ref AngularTargetGroup
LoadBalancerArn: !Ref MyALB
Port: 443
Protocol: HTTPS
Certificates:
- CertificateArn: !Ref MyCertificateArn

APIRule:
Type: AWS::ElasticLoadBalancingV2::ListenerRule
Properties:
Actions:
- Type: authenticate-oidc
AuthenticateOidcConfig:
Issuer: https://your-oidc-provider.com
AuthorizationEndpoint: https://your-oidc-provider.com/authorize
TokenEndpoint: https://your-oidc-provider.com/token
UserInfoEndpoint: https://your-oidc-provider.com/userinfo
ClientId: your-client-id
ClientSecret: '{{resolve:secretsmanager:YourSecretId:SecretString:ClientSecret}}'
SessionCookieName: AWSELBAuthSessionCookie
SessionTimeout: 14400
Scope: openid
OnUnauthenticatedRequest: authenticate
Order: 1
- Type: forward
Order: 2
ForwardConfig:
TargetGroups:
- TargetGroupArn: !Ref SpringBootTargetGroup
TargetGroupStickinessConfig:
Enabled: true
DurationSeconds: 14400
Conditions:
- Field: path-pattern
Values:
- /api/*
ListenerArn: !Ref ALBListener
Priority: 1

Continue reading...