bug: Cognito existing-user login returns an invalid authorization code on 2026.08.2

[edmonshi]

Current behavior

On localstack/localstack:2026.08.2 container, opening the Cognito login page sets an ls_cognito_token cookie containing client_id, code, and location, even before password authentication. The cookie has no username.

The hosted UI's existing-user action redirects to the cookie's location. Exchanging that callback's code at /_aws/cognito-idp/oauth2/token returns HTTP 400 with:

Invalid auth code specified

Fresh username/password login succeeds and its authorization code exchanges for tokens (HTTP 200). However, reopening the login page with that authenticated cookie replaces it with another cookie lacking username, and exchanging the new callback code fails again.

Expected behavior

An anonymous visitor should be shown the credentials form. After a successful login, if a remembered session is offered, continuing as that user should return a valid authorization code for the current request that can be exchanged for tokens.

Steps to reproduce

This reproduces on a clean stock container, a new pool/client/user, no application source, no startup patches, and no shared data volume. The script uses the image's installed boto3 and Python standard library. All requests stay inside the container.

1. Save the following files as compose.yaml and repro.py in an empty directory.
2. Set LOCALSTACK_AUTH_TOKEN in your shell to a token with Cognito access.
3. Run:

docker compose -p cognito-repro up -d --wait
docker compose -p cognito-repro exec -T localstack /opt/code/localstack/.venv/bin/python - < repro.py
# Remove the disposable test container and volume afterward:
docker compose -p cognito-repro down -v

The test covers two flows: direct /login with only the required OAuth parameters (no PKCE), and /oauth2/authorize with state, scopes, and PKCE. For password login it includes both InitiateAuth and the form POST used by the hosted UI.

This is an HTTP reproduction, not browser automation. It reads the cookie callback used by the hosted UI's existingProceed() function. Its assertions expect the observed failure, so exit status 0 means the bug reproduced.

compose.yaml

services:
  localstack:
    image: localstack/localstack:2026.08.2
    environment:
      SERVICES: cognito-idp
      AWS_DEFAULT_REGION: us-east-1
      LOCALSTACK_AUTH_TOKEN: ${LOCALSTACK_AUTH_TOKEN:?Set your LocalStack auth token}
      EAGER_SERVICE_LOADING: 1

repro.py (disposable test credentials only)

import base64, hashlib, json, secrets
import urllib.request as http
import urllib.parse as url
import urllib.error
from http.cookiejar import CookieJar
import boto3

base='http://localhost:4566'
c=boto3.client('cognito-idp',endpoint_url=base,region_name='us-east-1',aws_access_key_id='test',aws_secret_access_key='test')
pool=c.create_user_pool(PoolName='login-repro')['UserPool']['Id']
client=c.create_user_pool_client(UserPoolId=pool,ClientName='login-repro',GenerateSecret=False,ExplicitAuthFlows=['ALLOW_USER_PASSWORD_AUTH','ALLOW_REFRESH_TOKEN_AUTH'],CallbackURLs=['http://example.com'],AllowedOAuthFlows=['code'],AllowedOAuthScopes=['openid','email','profile'],AllowedOAuthFlowsUserPoolClient=True)['UserPoolClient']['ClientId']
c.admin_create_user(UserPoolId=pool,Username='test-user',MessageAction='SUPPRESS')
c.admin_set_user_password(UserPoolId=pool,Username='test-user',Password='TestPass123!',Permanent=True)
class NoRedirect(http.HTTPRedirectHandler):
 def redirect_request(self,*args): return None
for pkce in (False, True):
 jar=CookieJar()
 opener=http.build_opener(http.HTTPCookieProcessor(jar),NoRedirect())
 def req(path,data=None):
  try: response=opener.open(http.Request(base+path,data=url.urlencode(data).encode() if data is not None else None),timeout=15)
  except urllib.error.HTTPError as e: response=e
  with response: return response.status,response.headers,response.read()
 def start():
  verifier=secrets.token_urlsafe(32)
  params=dict(client_id=client,redirect_uri='http://example.com',response_type='code')
  if pkce: params.update(state=secrets.token_hex(16),scope='openid email profile',code_challenge=base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).decode().rstrip('='),code_challenge_method='S256')
  path='/_aws/cognito-idp/'+('oauth2/authorize' if pkce else 'login')+'?'+url.urlencode(params)
  s,h,b=req(path)
  while s in (301,302,303,307,308):
   target=url.urlsplit(h['Location'])
   assert not target.netloc or target.netloc=='localhost:4566'
   path=target.path+'?'+target.query
   s,h,b=req(path)
  assert s==200,(s,b)
  if not pkce:
   html=b.decode()
   marker=html.find('function existingProceed()')
   if marker >= 0: print('Button implementation:',html[marker:html.find('}',marker)+1],flush=True)
  return path,verifier
 def cookie(): return json.loads(base64.b64decode(next(v.value for v in jar if v.name=='ls_cognito_token')))
 def exchange(location,verifier):
  data=dict(grant_type='authorization_code',client_id=client,redirect_uri='http://example.com',code=url.parse_qs(url.urlsplit(location).query)['code'][0])
  if pkce: data['code_verifier']=verifier
  s,h,b=req('/_aws/cognito-idp/oauth2/token',data)
  return s,'tokens received' if s==200 else b.decode()
 print('FLOW:', 'authorize + PKCE' if pkce else 'minimal login, no PKCE',flush=True)
 path,v=start()
 print('Anonymous cookie fields:',sorted(cookie()),flush=True)
 result=exchange(cookie()['location'],v)
 print('Anonymous existing-user exchange:',result,flush=True)
 assert result==(400, 'Invalid auth code specified'), result
 auth=c.initiate_auth(ClientId=client,AuthFlow='USER_PASSWORD_AUTH',AuthParameters={'USERNAME':'test-user','PASSWORD':'TestPass123!'})
 assert 'AuthenticationResult' in auth
 s,h,b=req(path,dict(username='test-user',password='TestPass123!'))
 assert s==200,(s,b)
 result=exchange(h['Location'],v)
 print('Fresh password login:',result,flush=True)
 assert result[0]==200, result
 path,v=start()
 print('Remembered cookie fields:',sorted(cookie()),flush=True)
 result=exchange(cookie()['location'],v)
 print('Remembered-user exchange:',result,flush=True)
 assert result==(400, 'Invalid auth code specified'), result

Observed results

Both flows produced the same results:

Anonymous cookie fields: ['client_id', 'code', 'location']
Anonymous existing-user exchange: (400, 'Invalid auth code specified')
Fresh password login: (200, 'tokens received')
Remembered cookie fields: ['client_id', 'code', 'location']
Remembered-user exchange: (400, 'Invalid auth code specified')

Environment

• Host: macOS 26.4, Apple Silicon, Docker Compose.
• Image: localstack/localstack:2026.08.2.
• Tested local image ID: sha256:03e20255bd27eb6c5eee1e55d64ad97bbec46505981c92313481096e90f24fde.
• Cognito region: us-east-1.
• The same symptom was also reproduced on 2026.04.0 and 2026.08.0.

Investigation / related history

The observed cookie replacement appears to be the cause: opening the page supplies a new callback code that the token endpoint rejects, while the code from password authentication works. This happens without PKCE as well, so PKCE is not required to trigger it.

I searched existing open/closed issues and Discussions and did not find an exact match. Related history: #5310 introduced cookie-based re-login, and the reporter confirmed that behavior worked. That suggests a possible regression, but I have not identified the introducing version.

Is this a known issue, or is additional configuration required for the remembered-user flow? Happy to provide more info.