auth0 302 redirection failure with CDK v2 ,AWS ECS Fargate, CloudFront and WAF setup for WordPress website deployment

Question

Context: I have ECS Fargate setup with CloudFront + WAF setup. recently I integrated Okta auth0 authorization into my WordPress website. now when I trying to login with AWS with Auth0 integration. its giving me 302 redirection error. and its not allowed my users to logging.

this is my CloudFront behaviors

const distribution = new cloudfront.Distribution(
      this,
      `CloudFront-${name}`,
      {
        defaultBehavior: {
          origin: new origins.LoadBalancerV2Origin(alb, {
            protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
            httpsPort: 443,
            originSslProtocols: [cloudfront.OriginSslPolicy.TLS_V1_2],
            keepaliveTimeout: Duration.seconds(60),
            readTimeout: Duration.seconds(60),
            connectionAttempts: 3,
            connectionTimeout: Duration.seconds(10),
          }),
          viewerProtocolPolicy:
            cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
          cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
          originRequestPolicy: cloudfront.OriginRequestPolicy.ALL_VIEWER,
          allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
          cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
          responseHeadersPolicy:
            cloudfront.ResponseHeadersPolicy.SECURITY_HEADERS,
          // responseHeadersPolicy: corsStrict,
        },
        domainNames: [domainName],
        certificate,
      }
    );

```
distribution.addBehavior(
        "/wp-admin/*",
        new origins.LoadBalancerV2Origin(alb),
        {
          cachePolicy: cloudfront.CachePolicy.CACHING_DISABLED,
          originRequestPolicy: cloudfront.OriginRequestPolicy.ALL_VIEWER,
          viewerProtocolPolicy:
            cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
          allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
          cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
        }
      );

distribution.addBehavior(
        "/wp-login.php",
        new origins.LoadBalancerV2Origin(alb),
        {
          cachePolicy: cloudfront.CachePolicy.CACHING_DISABLED,
          originRequestPolicy: cloudfront.OriginRequestPolicy.ALL_VIEWER,
          viewerProtocolPolicy:
            cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
          allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL, 
          cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
        }
      );

distribution.addBehavior(
        "/wp-content/*",
        new origins.LoadBalancerV2Origin(alb),
        {
          cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
          originRequestPolicy: cloudfront.OriginRequestPolicy.ALL_VIEWER,
          viewerProtocolPolicy:
            cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
          allowedMethods: cloudfront.AllowedMethods.ALLOW_GET_HEAD, 
        }
      );

distribution.addBehavior(
        "/*.php",
        new origins.LoadBalancerV2Origin(alb),
        {
          cachePolicy: cloudfront.CachePolicy.CACHING_DISABLED,
          originRequestPolicy: cloudfront.OriginRequestPolicy.ALL_VIEWER,
          viewerProtocolPolicy:
            cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
          allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
          cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
        }
      );

distribution.addBehavior(
        "/index.php",
        new origins.LoadBalancerV2Origin(alb),
        {
          cachePolicy: cloudfront.CachePolicy.CACHING_DISABLED,
          originRequestPolicy: cloudfront.OriginRequestPolicy.ALL_VIEWER,
          viewerProtocolPolicy:
            cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
          allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
          cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
        }
      );
```

but WordPress website auth0 properly working with localhost. not in the server.
 anyone have a kind of same issue. please support for to find some tail to start working on that. or if you are facing some kind or 302 issue please share your thoughts. That would be really helpful.

Isha_P · Accepted Answer

Hello,

Thank you for contacting AWS.

Following seems to be the flow of your request : Viewer -> CloudFront -> ALB -> ECS configured with WordPress (where you have also added Auth0-Okta for authentication). 
When you try to authenticate using Auth0 to the WordPress website, you get 302 redirection error.

To address the issue that you are facing, we need some non-public details. Please use the following link to open a technical support case with the AWS Support team: https://console.aws.amazon.com/support/home#/case/create

While opening the case, please provide the HAR capture of the request. HAR capture is used to log the website interaction with the browser.

[+] https://repost.aws/knowledge-center/support-case-browser-har-file

re:Post Agent · Answer

The 302 redirection error you're experiencing with Auth0 integration in your WordPress site is likely related to how CloudFront handles redirects during the authentication flow. Auth0 uses HTTP redirects as part of its authentication process, and there are several potential issues in your CloudFront configuration that could be causing problems:

1. **Response Timeout Settings**: Your CloudFront distribution might be timing out before the complete authentication flow can finish. Auth0 authentication involves multiple redirects, and if CloudFront's timeout settings are too restrictive, the process may fail.

2. **WAF Rules**: If you have AWS WAF configured, it might be blocking or interfering with the redirects that are part of the Auth0 authentication flow. WAF rules can sometimes inadvertently block legitimate redirect patterns.

3. **Cache Behavior Configuration**: For authentication flows, you need to ensure that CloudFront isn't caching the authentication responses or redirects.

Here are some solutions to try:

1. **Create a specific behavior for Auth0 paths**: Add a new behavior in your CloudFront distribution specifically for the Auth0 callback URLs and authentication paths with caching disabled:

```
distribution.addBehavior(
"/auth/*", // Adjust this path pattern to match your Auth0 callback URLs
new origins.LoadBalancerV2Origin(alb),
{
cachePolicy: cloudfront.CachePolicy.CACHING_DISABLED,
originRequestPolicy: cloudfront.OriginRequestPolicy.ALL_VIEWER,
viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
allowedMethods: cloudfront.AllowedMethods.ALLOW_ALL,
}
);
```

2. **Adjust timeout settings**: Increase the timeout values in your CloudFront distribution to allow more time for the authentication flow to complete:

```
new origins.LoadBalancerV2Origin(alb, {
// Other settings...
readTimeout: Duration.seconds(120), // Increase from 60 to 120
connectionTimeout: Duration.seconds(10),
connectionAttempts: 3,
});
```

3. **Check WAF rules**: If you're using AWS WAF, review your rules to ensure they're not blocking Auth0 redirects. You might need to add specific allow rules for Auth0-related traffic.

4. **Configure a custom response headers policy**: Instead of using the predefined SECURITY_HEADERS policy, you might need to create a custom policy that allows for the headers needed during authentication:

```
const authHeadersPolicy = new cloudfront.ResponseHeadersPolicy(this, 'AuthHeadersPolicy', {
// Configure appropriate security headers that don't interfere with Auth0
});
```

5. **Consider using CloudFront Functions**: If the issue persists, you could implement a CloudFront Function to handle the specific redirect requirements of your Auth0 integration.

Since the authentication works on localhost but not in your AWS environment, the issue is likely related to how the redirects are being handled in your CloudFront distribution. Focus on ensuring that all parts of the Auth0 authentication flow can pass through CloudFront without being blocked, cached, or timing out.  
**Sources**  
[Amazon CloudFront introduces new origin response timeout controls - AWS](https://aws.amazon.com/about-aws/whats-new/2025/07/amazon-cloudfront-origin-response-timeout-controls/)  
[How to configure HTTP redirects in CloudFront | AWS re:Post](https://repost.aws/articles/ARhXqRGZr_TaiFfIptHK5-GA/how-to-configure-http-redirects-in-cloudfront)

auth0 302 redirection failure with CDK v2 ,AWS ECS Fargate, CloudFront and WAF setup for WordPress website deployment

Add your answer

Relevant content