How can I configure or redirect the /error endpoint from Cognito User Pool Hosted UI?

This can be achieved by adding a custom rule in Cognito Integrated WAF. Redirect URI path '/error' to your own url/page.

• General guidance of adding WAF rule to Userpool. => https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-waf.html
• General guidance of adding custom WAF rule for redirect => https://repost.aws/knowledge-center/waf-uri-paths

If you found the rule does not work with 302 response code and custom response header 'Location', add an additional response JSON body may do the trick. I tested with that and worked as expected.

BTW, this currently, Apr 2025, only works with Hosted UI v1. Managed UI, aka Hosted UI v2 does not support WAF integration yet.

Unfortunately, there isn't a direct way to configure or redirect the /error endpoint from the Cognito User Pool Hosted UI. The Hosted UI is a managed service provided by AWS Cognito, and its error handling is not customizable in the way you're looking for.

The hidden CloudFront distribution that Cognito uses for the Hosted UI is not accessible or configurable by users. This means you can't modify its behavior or add custom error pages or redirects at that level.

While it's not possible to intercept or customize the /error path directly within the Cognito Hosted UI, there are a couple of alternative approaches you might consider:

1. Instead of relying on the Hosted UI, you could implement a custom UI for your application. This would give you full control over the authentication flow and error handling, allowing you to manage situations where the state parameter is missing.

2. You could implement a proxy or middleware layer in your application that intercepts requests before they reach the Cognito Hosted UI. This could potentially allow you to add the missing state parameter or handle errors before they reach the Cognito error page.

3. If possible, work with your OIDC provider to ensure they send the required state parameter. This is the most straightforward solution, as it addresses the root cause of the issue.

4. You could implement WAF with the rule that redirect anything /error path to URL that you want.

It's worth noting that the state parameter is an important security feature in OAuth 2.0 flows, used to prevent cross-site request forgery (CSRF) attacks. Bypassing this requirement is not recommended from a security standpoint.

If none of these options are feasible, you may need to reach out to AWS support for further assistance or to request this feature. They might be able to provide more specific guidance based on your use case or consider adding this functionality in future updates to the service.
Sources
Updating a Cognito Login Error Message | AWS re:Post
The managed login sign-out endpoint: /logout - Amazon Cognito