Error: Failed to fetch https://cognito-idp.sa-east-1.amazonaws.com/<POOL_ID>/.well-known/jwks.json in Next.js app at server side.

[naveensgs]

Question
I am using steps provided here in the Next.js project to verify JWT token. I always end up with this (Attached screenshot) error. It works once in a while and fails most of the case in local development. But when the app is deployed in AWS it just works fine without any error. I did increase timeout, wrote a custom methods to decode token and did test it using curl command everything just works fine except in node.js app. Please help if there is any fix or configuration i need to do in cognito dashboard.

Versions
Which version of aws-jwt-verify are you using? Latest
Are you using the library in Node.js or in the Web browser? Node.js
If Node.js, which version of Node.js are you using? (Should be at least 18) 22.16
If Web browser, which web browser and which version of it are you using? None
If using TypeScript, which version of TypeScript are you using? (Should be at least 4) 5

[ottokruse]

3 seconds should be ample to download the JWKS anywhere in the world because it is a small JSON file served by CDN. So unless your internet is really slow/flaky that shouldn't be the issue.

Which leaves other potential root causes, ones that I've seen before:

• you need to use a HTTP proxy locally because you are in a corporate network where your code cannot just reach out to internet to download the JWKS --> solution is to use an agent with HTTP proxy, search the issues here for HTTP proxy and you'll find sample code
• your network has network routing rules that route traffic to amazonaws.com addresses to an internal only endpoint such as a VPC endpoint but this doesn't work for the Cognito JWKS as it's on the public internet (by design) --> solution is to fix your routing rules (sorry, probably not under your control)

A work around that works in either case is to load the JWKS from file (see README) instead of over the public internet. But then there's some extra deployment hassle to do that and bundle it with the code (and at some point Cognito may start rotating JWKS in which case you still need internet access--however currently Cognito does not do that)

[naveensgs]

Hi @ottokruse ,

Thanks for the detailed explanation.

It’s definitely not an internet issue in my case — I’m on a high-speed connection, and I’m not on a corporate network. I’m running the application locally, so there’s no proxy involved either.

Let me know if there are any other potential causes I should check.

[ottokruse]

There is no other cause that I have seen before (other than, your internet is flaky).

Try doing a direct fetch in Node.js to the JWKS uri (ask ChatGPT to write a snippet of code, e.g. see below). Does that work?

'''
const region = 'us-east-1';
const userPoolId = 'us-east-1_XXXXXXX';

async function fetchJwks(region, userPoolId) {
const url = https://cognito-idp.${region}.amazonaws.com/${userPoolId}/.well-known/jwks.json;
const res = await fetch(url);
if (!res.ok) throw new Error(Failed to fetch JWKS: ${res.status});
return res.json();
}

fetchJwks(region, userPoolId)
.then(jwks => console.log(jwks))
.catch(err => console.error(err));
'''