Spring Boot oAuth2.0 authorization_request_not_found

Question

i have following Setup: Cloudflare (Proxy) -> Nginx (Reverse Proxy) -> Tomcat (Spring Boot)

I want to integrate discord with oAuth on my webpage, but ran into the following Problem: If I use the browser Firefox and try to pass the oAuth authentification i get the error [authorization_request_not_found]. In Google Chrome and Microsoft Edge it works perfectly. The Problem only appears if i test it on the Server with the domain and cloudflare proxy. If i test locally with firefox & localhost:8080 it also works perfectly.

Here is the URL to the oAuth button: https://playlegend.net/apply

My applications.properties:

spring.security.oauth2.client.registration.discord.client-id=<clientid>
spring.security.oauth2.client.registration.discord.client-secret=<clientsecret>
spring.security.oauth2.client.registration.discord.client-authentication-method=post
spring.security.oauth2.client.registration.discord.authorization-grant-type=authorization_code
spring.security.oauth2.client.registration.discord.scope=identify,email
spring.security.oauth2.client.registration.discord.redirect-uri=https://playlegend.net/login/oauth2/code/discord
spring.security.oauth2.client.registration.discord.clientName=PlayLegend

spring.security.oauth2.client.provider.discord.authorization-uri=https://discordapp.com/api/oauth2/authorize
spring.security.oauth2.client.provider.discord.tokenUri=https://discordapp.com/api/oauth2/token
spring.security.oauth2.client.provider.discord.user-info-uri=https://discordapp.com/api/users/@me
spring.security.oauth2.client.provider.discord.user-name-attribute=username

security.oauth2.client.pre-established-redirect-uri=https://playlegend.net/login
security.oauth2.client.registered-redirect-uri=https://playlegend.net/login
security.oauth2.client.use-current-uri=false
server.tomcat.remote-ip-header=x-forwarded-for
server.tomcat.protocol-header=x-forwarded-proto

server.tomcat.use-relative-redirects=true
server.use-forward-headers=true
server.tomcat.internal-proxies=.*

server.port=8080

I use spring-security-oauth2-client and Spring Boot Version v2.5.3.

I hope someone can help me.

Thanks and best regards

Answer 1

In my case, it is caused by not using distributed sessions. So the app works well on the local machine, but when deploying multiple instances behind a load balancer the error occurs -- since sessions are not shared.

Finally, I used Spring Session with Redis to resolve it. I also tried to use a client-side cookie (security here is not a big concern) but found it requires more customized code so I give up.