Cognito Facebook login with "attributes required: [email]" error
I've published my Facebook App with email and public_profile permissions approved.
My Cognito settings:
- Facebook IdP
- Authorized scopes: public_profile, email
- field mapping
- Client
- Authentication flows
- ALLOW_REFRESH_TOKEN_AUTH
- ALLOW_USER_PASSWORD_AUTH
- ALLOW_USER_SRP_AUTH
- hosted UI
- Authentication flows
When I try in facebook debug tool, I'm able to get the email
But end up I got this error attributes required: [email] from the returned URL
https://auth.domain/auth/callback/?error_description=attributes%20required%3A%20%5Bemail%5D&error=invalid_request#_=_
What else am I missing?
Edit-1 on 2024-10-27: Add Facebook & Cognito settings
Facebook App is in Live mode
Facebook approved public_profile & email
Cognito Identity provider settings
- Newest
- Most votes
- Most comments
I finally found the root cause, I removed the custom attribute mapping, solved the issue
Based on the information provided, it seems that you're encountering an issue where Cognito is not receiving the email attribute from Facebook during the authentication process, despite having the correct permissions and configurations. Here are a few things to check and consider:
-
Verify that the email attribute is actually being returned by Facebook. Even if you have the permission, some users might not have an email associated with their Facebook account or may have chosen not to share it.
-
Check your Facebook app settings to ensure that the "email" permission is not only approved but also included in the Default Access for your app.
-
In your Cognito User Pool settings, make sure that the email attribute is not set as a required attribute. If it's set as required and Facebook doesn't return an email for some reason, Cognito will throw this error.
-
Double-check your attribute mapping in Cognito. Ensure that the Facebook "email" attribute is correctly mapped to the Cognito "email" attribute.
-
If you're using any Lambda triggers with your Cognito User Pool, especially the Pre Sign-up or Pre Token Generation triggers, make sure they're not interfering with the email attribute.
-
Try clearing your browser cache and cookies, or test in an incognito/private browsing window to ensure there are no lingering session issues.
-
If possible, try the authentication flow with a different Facebook account to see if the issue is specific to one account or occurs for all users.
If after checking these points the issue persists, you may want to enable Cognito logging and check the CloudWatch logs for more detailed error information. This could provide more insight into why Cognito is not receiving or processing the email attribute correctly.
Sources
Hosted UI and federation error responses - Amazon Cognito
Add more features and security options to your user pool - Amazon Cognito
SchemaAttributeType - Amazon Cognito User Pools
To fix the attributes required: [email] error in Cognito when connecting via Facebook:
Facebook App Settings: Confirm public_profile and email permissions are both approved and the app is in Live mode. Cognito IdP Settings: Ensure Authorized Scopes include public_profile and email. Attribute Mapping: Map Facebook’s email field to Cognito’s email attribute in Attribute Mapping. Clear Cache: Clear cached sessions before re-testing to avoid configuration conflicts. These steps should resolve the missing email issue.
Relevant content
asked 3 years ago
asked 5 years ago
Hi Adeleke, I've done all you mentioned previously (added screenshots to the question), but the missing email issue persisted. I even try in different environment and asked my friend to login with his Facebook account, still the same.