401 Errors on OpenID Configuration and JWKS Endpoints with AWS API Gateway
Last Updated:
Overview
This article clarifies the reason for frequently observing 401 errors when an Amazon Web Services (AWS) API Gateway makes requests to the /.well-known/openid-configuration and /.well-known/jwks.json OpenID Connect (OIDC) endpoints.
Applies To
- Amazon Web Services (AWS) API
- OpenID Connect (OIDC) endpoints
Cause
The issue is a known behavior caused by intermittent network issues, which result in slow cache responses mixed with an apparent hard limit of 1500 milliseconds timeout imposed by Amazon Web Services (AWS) for these kinds of requests. Consult Amazon API Gateway quotas and important notes.
Solution
To minimize the occurrence of these errors, cache the endpoints and reduce the number of requests to the /.well-known/* endpoints. This approach is recommended in the documentation:
-
Review documentation on Reduce calls to Auth0.
-
Consult instructions to Locate JSON Web Key Sets (JWKS).
-
Configure JSON Web Token (JWT) Authorizers to cache public keys for up to two hours at a time. Refer to item 3 in Controlling access to HTTP APIs with JWT authorizers.
