ALB Cookie expirations that does not bring user to a proper login screen

The issue you're experiencing with the ALB (Application Load Balancer) and Cognito authentication setup is complex and involves several components of the authentication flow. Let's break down the problem and provide some insights:

1. 401 Unauthorized Error: When users see a "401 Not Authorized" message with the Cognito token endpoint URL (/oauth2/idpresponse), it suggests that the authentication flow is failing at the token exchange step. This could happen if the authorization code has expired or is invalid when the ALB tries to exchange it for tokens.

2. Session Cookie Expiration: The fact that manually expiring the AWSELB session cookies reproduces the issue indicates that the problem is related to session management. When these cookies expire, the ALB should initiate a new authentication flow, starting from step 1 of the process.

3. Inconsistent Behavior: The inconsistent behavior you're observing (sometimes getting a 401, sometimes regenerating cookies automatically) could be due to timing issues or race conditions in the authentication flow. It's possible that in some cases, the refresh token is still valid and being used to obtain new access tokens silently.

4. Corporate Environment Factors: Since the workstations are within a corporate environment, there might be network configurations, proxies, or security measures interfering with the authentication flow. These could potentially cause issues with redirects or cookie handling.

Possible explanations and solutions:

1. Token Expiration Mismatch: Ensure that the expiration times for ALB authentication session, Cognito tokens, and your corporate AD tokens are aligned properly. Mismatched expiration times can lead to scenarios where one component thinks the session is valid while another doesn't.

2. Refresh Token Usage: Implement a mechanism to use refresh tokens to silently renew the session before the access token expires. This can help prevent the need for a full re-authentication flow.

3. Error Handling: Improve error handling in your application to catch authentication failures and redirect users to the login page instead of showing a 401 error.

4. Session Extension: Consider implementing a session extension mechanism that warns users before their session expires and allows them to extend it without a full re-login.

5. ALB Configuration: Review your ALB authentication rules and ensure they're configured to handle unauthenticated requests properly, redirecting to the login page when necessary.

6. Cognito Settings: Check your Cognito user pool settings, particularly the token expiration times and refresh token usage.

7. Network Analysis: Conduct a thorough network analysis to ensure there are no corporate network policies or configurations interfering with the authentication flow.

To resolve the issue:

1. Implement proper session management and token refresh mechanisms in your application.
2. Adjust token expiration times to better suit your use case.
3. Improve error handling to gracefully redirect users to the login page when authentication fails.
4. Consider implementing a session extension feature to prevent unexpected logouts.
5. Review and potentially adjust your ALB and Cognito configurations to ensure they align with your authentication requirements.

By addressing these points, you should be able to improve the user experience and resolve the mysterious behavior you're encountering.
Sources
Security best practices when using ALB authentication | Networking & Content Delivery
The hosted UI sign-in endpoint: /login - Amazon Cognito
Authenticate users using an Application Load Balancer - Elastic Load Balancing
Need to warn user prior to cognito session expiration | AWS re:Post
The token revocation endpoint - Amazon Cognito