Cognito Facebook IDP fails after signin

Good day!

We are planning to use cognito userpool for social login following developer's guide: Adding social identity providers to a user pool. Google IDP is working but Facebook sends us to an error page after logging in: "Sorry, something went wrong."

Can you help us determine what we are doing wrong? Below are some information with our implementation.

1. Facebook App Inputs:

Domain
https://fb-idp-test.auth.ap-northeast-1.amazoncognito.com

Website Site Url
https://fb-idp-test.auth.ap-northeast-1.amazoncognito.com/login?response_type=code&client_id=<userpool-client-id>&redirect_uri=https://www.example.com

Valid OAuth Redirect URIs
https://fb-idp-test.auth.ap-northeast-1.amazoncognito.com/oauth2/idpresponse

2. Cognito Userpool via CDK: Sample taken from github aws-samples cognito-idp-stack Facebook IDP. Added "public_profile" to scope per developer's guide.

    const facebookAppId = "XXXXXXXXXXXXXXXX";
    const facebookAppSecret = "XXXXXXXXXXXXXXXXXXXXXXXX";
    const redirectUri = "https://www.example.com";

    // Cognito User Pool
    const userPool = new cognito.UserPool(this, "CognitoIDPUserPool", {
      userPoolName: "fb-idp-userpool",
      selfSignUpEnabled: false,
      signInAliases: {
        email: true,
        username: true,
      },
      standardAttributes: {
        email: {
          mutable: true,
          required: true,
        },
        givenName: {
          mutable: true,
          required: true,
        },
        familyName: {
          mutable: true,
          required: true,
        },
      },
    });

    // Facebook IDP
    const idp = new cognito.UserPoolIdentityProviderFacebook(this, "FacebookIDP",
      {
        clientId: facebookAppId,
        clientSecret: facebookAppSecret,
        scopes: ["public_profile", "email"],
        userPool,
        attributeMapping: {
          email: cognito.ProviderAttribute.FACEBOOK_EMAIL,
          familyName: cognito.ProviderAttribute.FACEBOOK_LAST_NAME,
          givenName: cognito.ProviderAttribute.FACEBOOK_FIRST_NAME,
        },
      }
    );

    // Configure the user pool client application
    const userPoolClient = new cognito.UserPoolClient(this, "CognitoAppClient",
      {
        userPool,
        authFlows: {
          userPassword: true,
        },
        oAuth: {
          flows: {
            authorizationCodeGrant: true,
          },
          scopes: [
            cognito.OAuthScope.PHONE,
            cognito.OAuthScope.EMAIL,
            cognito.OAuthScope.PROFILE,
            cognito.OAuthScope.OPENID,
          ],
          callbackUrls: [redirectUri],
        },
        generateSecret: false,
        userPoolClientName: "Web",
        supportedIdentityProviders: [
          cognito.UserPoolClientIdentityProvider.FACEBOOK,
        ],
      }
    );

    // Make sure the user pool client is created after the IDP
    userPoolClient.node.addDependency(idp);

    // Add the domain to the user pool
    userPool.addDomain("CognitoDomain", {
      cognitoDomain: {
        domainPrefix: "fb-idp-test",
      },
    });

Thank you very much!

Regards,

Cyrus