Status Code: 502 Bad Gateway Request URL https://*myBffUrl*/signin-oidc?code=....

[AATerekhov]

Thanks in advance.
Hi,
I am faced with the problem of hosting the React-Vite application on a virtual machine in my cloud. I use split hosts in docker containers and hide them behind a reverse proxy server. There are no problems with local testing. But there is a problem in the work environment.

There is no problem with local testing.

[AATerekhov]

I'm sorry for the scant information, here's the Bffs logs:

[13:58:54 Information] Serilog.AspNetCore.RequestLoggingMiddleware
HTTP GET /bff/login responded 302 in 177.2336 ms

[13:58:54 Information] Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler
AuthenticationScheme: cookie signed in.

[13:58:54 Information] Serilog.AspNetCore.RequestLoggingMiddleware
HTTP GET /signin-oidc responded 302 in 230.9153 ms

[14:02:47 Error] Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler
Message contains error: 'invalid_grant', error_description: 'error_description is null', error_uri: 'error_uri is null', status code '400'.

[14:02:47 Error] Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler
Exception occurred while processing message.
Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolException: Message contains error: 'invalid_grant', error_description: 'error_description is null', error_uri: 'error_uri is null'.
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RedeemAuthorizationCodeAsync(OpenIdConnectMessage tokenEndpointRequest)
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()

[aaronclawrence]

A 502 error can't be coming from Identity Server, AFAIK. That's a gateway error from a proxy or similar, in our kubernetes case it usually means the pod has crashed

[AATerekhov]

Thanks for the help.
At the moment, I have found this article that works with version 4.0 of Bff.
But maybe the problem is with the external proxy server itself.
https://docs.duendesoftware.com/bff/fundamentals/options/#proxy-servers-and-load-balancers

[maartenba]

You will indeed need the X-Forwarded-... headers enabled.

[Erwinvandervalk]

Looking at the logs, it's the identity provider that returns the error 'invalid_grant' and a 400 status code. This turns into an exception in the microsoft authentication library and makes the BFF return a 500 error. Your reverse proxy then turns that into a 502 error.

Now the question is, why are you getting the invalid grant error?

Can you first verify that the authentication flow works correctly against your cloud identity provider?

[AATerekhov]

Erwin, thank you for your reply. I'll try to figure out the cause of error 400.