0

I'm trying to setup load balancer for multiple services. Each service has own external ELB. I don't want to use subdomains for service1, service2... because of the CORS and want to get rid of OPTIONS request.

I'm using CloudFront and Behaviors for that. Website is a SPA.

https://beta.myapp.com  - main page → S3
https://beta.myapp.com/api/service1/v1/* → service1 ELB
https://beta.myapp.com/api/service2/v1/* → service2 ELB

When I setup behavior for service1 without any forwarding I'm geting error from my service - 401 Unauthorized. Because it's rely on the cookie for unauthorization.

After I'm set Forward Cookies - All or Whitelist myapp-api-token* - I start getting 404 error and redurect to my error static page. I don't see in the service logs that my service was requested.

The other options like Cache Based on Selected Request Headers and Query String Forwarding and Caching not affecting anything at all.

  • What might be a problem?
  • How to debug or log routing in CloudFront?

Might be important to mention that cookie is Secured and HttpOnly.

Example of the cookie:

cookie: myapp-api-token=eyJraWQiOiJyRlZYTGpCRVJJRDZ6MVVpSVpDaENVQVczNlRua0FMb3dDQzlHMnBmcG1VPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiJiZGYzNjNiOC1jMWM3LTQzNDMtOTc2My0zOTk3ZDFiNTYxZWQiLCJjdXN0b206a2V5U3BlYyI6IkFFU18yNTYiLCJpc3MiOiJodHRwczpcL1wvY29nbml0by1pZHAudXMtZWFzdC0xLmFtYXpvbmF3cy5jb21cL3VzLWVhc3QtMV9FRzlwSjRsb0giLCJjdXN0b206ZW5jcnlwdGVkUGFzc3dvcmQiOiJBUUVDQUhqa3BxM0pmUzNId0c1XC92cTNicHY4TUdjaWhJZ0hReVFsQk1OY09Ea1JZOHdBQUFIb3dlQVlKS29aSWh2Y05BUWNHb0dzd2FRSUJBREJrQmdrcWhraUc5dzBCQndFd0hnWUpZSVpJQVdVREJBRXVNQkVFREo5b2hwYSt2WnNMdXBQXC9sQUlCRUlBM3RCOUFrRWhjR0hJSFhiSitnXC9DRUZ3REljc3EzaEpBTVlxTVZmS2g1ZmZIVW9BMGp2YzU2NzJGcEpjK3BWbzdTMytZXC9nWVdqMnc9PSIsImNvZ25pdG86dXNlcm5hbWUiOiJDTE9VREZMT1ctdXMtZWFzdC0xOjAxNDE4ZDJhLWJlZGYtNDgzYy05NjFlLWE0YjQ5MjRhNjhkZCIsInByZWZlcnJlZF91c2VybmFtZSI6IkNMT1VERkxPVy11cy1lYXN0LTE6M2VmZjBmYWItN2RiZC00YjhjLTk0YmMtMjZkZDIyODIyY2IyIiwiYXVkIjoiM3A5aHMxc2VrOGo0OXNwbjY2MjNmbWFuMGIiLCJldmVudF9pZCI6IjZiMmEyY2RkLTU3MTAtMTFlOS1hNmU1LTliYTBlYmUzYTkyMCIsInRva2VuX3VzZSI6ImlkIiwiYXV0aF90aW1lIjoxNTU0NDA2MzY0LCJuYW1lIjoiRGVuaXMgTGlnZXIiLCJjdXN0b206ZW5jcnlwdGVkRGF0YUtleSI6IkFRRURBSGprcHEzSmZTM0h3RzVcL3ZxM2JwdjhNR2NpaElnSFF5UWxCTU5jT0RrUlk4d0FBQUg0d2ZBWUpLb1pJaHZjTkFRY0dvRzh3YlFJQkFEQm9CZ2txaGtpRzl3MEJCd0V3SGdZSllJWklBV1VEQkFFdU1CRUVES081SUZocFwva3UzTjhneXpnSUJFSUE3dm1XdTlnVlg2K0IrdDIrQVppSmFcL0FXVFwvSnZPWEFWMXBGNVhXdFRzVjluaDhWa2ZEQXk5S3BZTGY3bWR0TVkxZGRhSlVyVFJ1ZDhzYTFzPSIsImV4cCI6MTU1NDg1NTQ2MiwiaWF0IjoxNTU0ODUxODYyLCJlbWFpbCI6ImxpZ2RlbmlzQGFtYXpvbi5jb20ifQ.bfFCwH6nN3mAXxwDuwyE7yZMqVwMKnOISP0jwLWZGodZ--oUepPPTvpxWskqxEqpL-Jy_rAki_g319d3opnDKaGVq0FJZjW9EneRxjPHsziUoJHysRSJrj0joCWtYGVzXB7UA6VOlO1CiqGK1i9SMG8k3i6b5EbsDWr84c_wvlVi8yy8M33oJfTLRIbFeDDYwexdT9ZDK9_rcLxnDLL3XjIqlKLj9rCsKOrEIznwZLsCfrBjQBZE8mq9VHUaajFpochyaM1rjL9J8q9-tZTcHnE1ryrLNLvW_vtS1WLic1WVTw9TkCQJCc1HT3KyI-mmqc4fg7Vyw7_RC3DcbiV7Rw
Dennis Liger
  • 1,488
  • 2
  • 13
  • 28
  • I don't think the problem is CloudFront or the cookie itself... but I wonder whether your ELB is actually expecting the full path you are sending, e.g. `/api/service1/v1/...`. By default, CloudFront sets the outgoing path to the origin the same as the browser sent it. The configured path pattern does not get removed. Is that potentially the problem? – Michael - sqlbot Apr 10 '19 at 02:03

1 Answers1

0

I guess you're using "Cache behavior" with "Path Pattern" to route user request to Origin? If that so, check the order of your behavior, as you list in your question, you put the * pattern in the first order, mean all request will be route to S3 which will cause 404 not found error since your S3 site doesn't have that URL path.

Dominic Nguyen
  • 753
  • 6
  • 11
  • Yes. My path pattern on the first place. It stop working only when I start forwarding cookies by some reason.... =( – Dennis Liger Apr 10 '19 at 16:58