Why is `login_required` not returned in redirect URL when using AWS Cognito with Authorization...

I'm using AWS Cognito with Authorization Code Grant flow for authentication in my Angular application. I’ve configured the following:

• Authorization flow: Authorization Code Grant
• Domain and redirect URIs: Correct and matching what’s configured in the Cognito App Client
• Login flow: Using prompt=none for silent login attempt
• App Client: Using a hosted UI (managed login configuration)

Problem

When the user is not logged in or the session has expired, I expect the Cognito authorization server to respond with a redirect containing error=login_required (per the OIDC spec). However, this parameter is not returned, and the user is instead :

• redirected to the login page

What I’ve Checked The Cognito App Client has:

• 
  Authorization code grant enabled
  
  
• 
  Hosted UI with proper domain setup
  
  
• 
  Allowed callback URLs set to my redirect_uri
  

The domain and redirect_uri in the request match exactly with the app client configuration

What I Need Help With Why doesn’t AWS Cognito return error=login_required in the redirect URL when there's no active session during a silent login attempt with prompt=none? Is this a known limitation, or is there something misconfigured on my side?

Here’s how I build the silent login URL:

const silentLogin = `${this.domain}/oauth2/authorize?` +
`response_type=code&client_id=${this.clientId}&` +
`redirect_uri=${encodeURIComponent(this.redirectUri)}&` +
`scope=${this.authScope}&prompt=none`;

window.location.href = silentLogin;

Continue reading...