Cognito OAuth /oauth2/authorize flow broken when using CloudFront in front of ALB

Hello.

Have you already reviewed the information in the following document?
You will need to configure CloudFront to forward all request headers to the origin server.
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html#cloudfront-requirements

Prepare to use Amazon CloudFront
Enable the following settings if you are using a CloudFront distribution in front of your Application Load Balancer:

• Forward request headers (all) — Ensures that CloudFront does not cache responses for authenticated requests. This prevents them from being served from the cache after the authentication session expires. Alternatively, to reduce this risk while caching is enabled, owners of a CloudFront distribution can set the time-to-live (TTL) value to expire before the authentication cookie expires.
• Query string forwarding and caching (all) — Ensures that the load balancer has access to the query string parameters required to authenticate the user with the IdP.
• Cookie forwarding (all) — Ensures that CloudFront forwards all authentication cookies to the load balancer.
• When configuring OpenID Connect (OIDC) authentication in conjunction with Amazon CloudFront, ensure that HTTPS port 443 is consistently used throughout the entire connection path. Otherwise, authentication failures can occur because the client OIDC redirect URLs do not match the port number of the originally generated URI.

If the above method does not resolve the issue, you can also configure Lambda@Edge on CloudFront and perform authentication using Cognito, so please check that out as well.
https://github.com/awslabs/cognito-at-edge