Q: Invalid session id error in Spring Security OAuth Authorization Server integrated with nginx proxy I am trying to fix an issue with invalid session id error in the Spring Security OAuth Authorization Server. It is integrated with an nginx proxy running on a remote server. Spring servers and nginx proxy are installed on the same machine.
There are three Spring servers running on separate ports:

*

*client server running on port 8080

*resource server running on port 8090

*authorisation server running on port 9000

NGINX configuration file
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 4096;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

    ssl_protocols           TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers             HIGH:!aNULL:!MD5;
    ssl_certificate         /etc/nginx/cert.crt;
    ssl_certificate_key     /etc/nginx/cert.key;
    ssl_session_cache       shared:SSL:10m;
    ssl_session_timeout     10m;

server {
        listen       443 ssl;
        listen       [::]:443 ssl;
        server_name  _;
        root        /data/www;
        absolute_redirect off;

        location / {
                index   index.html index.php;
                proxy_set_header Referer "";
        }

        location /authenticate {
                proxy_http_version 1.1;
                proxy_pass http://127.0.0.1:8080/authenticate;
                proxy_redirect http://auth-server:9000/ https://111.111.11.111:22222/;
                proxy_redirect http://127.0.0.1:8080/ https://111.111.11.111:22222/;
        }

        location /oauth2/authenticate {
                proxy_http_version 1.1; 
                proxy_pass http://127.0.0.1:8080//oauth2/authenticate;
                proxy_redirect http://auth-server:9000/ https://111.111.11.111:22222/;
       }
...


Redirects appear to be working as expected but authentication fails after entering user credentials.
Client server log has the following entery that shows an invalid session id request (third line from the bottom - o.s.s.w.session.SessionManagementFilter  : Request requested invalid session id CBE7BC7B1ABAC7F69908F6D0536A32CE
):
2022-07-07 15:00:17.596 DEBUG 11690 --- [nio-8080-exec-8] o.s.s.web.DefaultRedirectStrategy        : Redirecting to http://auth-server:9000/oauth2/authorize?response_type=code&client_id=client&scope=openid&state=giGRLf_DyH5GziZfHvjWlVlMo-cDELAX6E5sfLJkPM8%3D&redirect_uri=http://127.0.0.1:8080/login/oauth2/code/client-oidc&nonce=2GNlYXwjZS2bqoZ-73kSkqc_TFu_eImnH05iEsxO2UE

2022-07-07 15:00:17.596 DEBUG 11690 --- [nio-8080-exec-8] w.c.HttpSessionSecurityContextRepository : Did not store empty SecurityContext

2022-07-07 15:00:17.596 DEBUG 11690 --- [nio-8080-exec-8] w.c.HttpSessionSecurityContextRepository : Did not store empty SecurityContext

2022-07-07 15:00:17.596 DEBUG 11690 --- [nio-8080-exec-8] s.s.w.c.SecurityContextPersistenceFilter : Cleared SecurityContextHolder to complete request

2022-07-07 15:00:17.596 DEBUG 11690 --- [nio-8080-exec-8] o.apache.coyote.http11.Http11Processor   : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@278d5e31:org.apache.tomcat.util.net.NioChannel@2be48f79:java.nio.channels.SocketChannel[connected local=/127.0.0.1:8080 remote=/192.111.111.222:55200]], Status in: [OPEN_READ], State out: [CLOSED]

2022-07-07 15:00:17.596 DEBUG 11690 --- [nio-8080-exec-8] o.apache.tomcat.util.threads.LimitLatch  : Counting down[http-nio-8080-exec-8] latch=1

2022-07-07 15:00:17.596 DEBUG 11690 --- [nio-8080-exec-8] org.apache.tomcat.util.net.NioEndpoint   : Calling [org.apache.tomcat.util.net.NioEndpoint@64e25661].closeSocket([org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@278d5e31:org.apache.tomcat.util.net.NioChannel@2be48f79:java.nio.channels.SocketChannel[connected local=/127.0.0.1:8080 remote=/192.111.111.222:55200]])

2022-07-07 15:01:02.647 DEBUG 11690 --- [o-8080-Acceptor] o.apache.tomcat.util.threads.LimitLatch  : Counting up[http-nio-8080-Acceptor] latch=1

2022-07-07 15:01:02.648 DEBUG 11690 --- [nio-8080-exec-9] o.a.coyote.http11.Http11InputBuffer      : Before fill(): parsingHeader: [true], parsingRequestLine: [true], parsingRequestLinePhase: [0], parsingRequestLineStart: [0], byteBuffer.position(): [0], byteBuffer.limit(): [0], end: [629]

2022-07-07 15:01:02.648 DEBUG 11690 --- [nio-8080-exec-9] o.a.tomcat.util.net.SocketWrapperBase    : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@462a89b9:org.apache.tomcat.util.net.NioChannel@2be48f79:java.nio.channels.SocketChannel[connected local=/127.0.0.1:8080 remote=/192.111.111.222:55200]], Read from buffer: [0]

2022-07-07 15:01:02.648 DEBUG 11690 --- [nio-8080-exec-9] org.apache.tomcat.util.net.NioEndpoint   : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@462a89b9:org.apache.tomcat.util.net.NioChannel@2be48f79:java.nio.channels.SocketChannel[connected local=/127.0.0.1:8080 remote=/192.111.111.222:55200]], Read direct from socket: [556]

2022-07-07 15:01:02.648 DEBUG 11690 --- [nio-8080-exec-9] o.a.coyote.http11.Http11InputBuffer      : Received [GET /authenticate HTTP/1.1
Host: 127.0.0.1:8080
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cookie: JSESSIONID=CBE7BC7B1ABAC7F69908F6D0536A32CE
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache

]

2022-07-07 15:01:02.648 DEBUG 11690 --- [nio-8080-exec-9] o.a.t.util.http.Rfc6265CookieProcessor   : Cookies: Parsing b[]: JSESSIONID=CBE7BC7B1ABAC7F69908F6D0536A32CE

2022-07-07 15:01:02.648 DEBUG 11690 --- [nio-8080-exec-9] o.a.catalina.connector.CoyoteAdapter     :  Requested cookie session id is CBE7BC7B1ABAC7F69908F6D0536A32CE

2022-07-07 15:01:02.648 DEBUG 11690 --- [nio-8080-exec-9] o.a.c.authenticator.AuthenticatorBase    : Security checking request GET /authenticate

2022-07-07 15:01:02.648 DEBUG 11690 --- [nio-8080-exec-9] org.apache.catalina.realm.RealmBase      :   No applicable constraints defined

2022-07-07 15:01:02.648 DEBUG 11690 --- [nio-8080-exec-9] o.a.c.authenticator.AuthenticatorBase    : Not subject to any constraint

2022-07-07 15:01:02.649 DEBUG 11690 --- [nio-8080-exec-9] o.s.security.web.FilterChainProxy        : Securing GET /authenticate

2022-07-07 15:01:02.649 DEBUG 11690 --- [nio-8080-exec-9] s.s.w.c.SecurityContextPersistenceFilter : Set SecurityContextHolder to empty SecurityContext

2022-07-07 15:01:02.649 DEBUG 11690 --- [nio-8080-exec-9] o.s.s.w.a.AnonymousAuthenticationFilter  : Set SecurityContextHolder to anonymous SecurityContext

2022-07-07 15:01:02.649 DEBUG 11690 --- [nio-8080-exec-9] org.apache.tomcat.util.http.Parameters   : Set encoding to UTF-8

2022-07-07 15:01:02.649 DEBUG 11690 --- [nio-8080-exec-9] o.s.s.w.session.SessionManagementFilter  : Request requested invalid session id CBE7BC7B1ABAC7F69908F6D0536A32CE

2022-07-07 15:01:02.649 DEBUG 11690 --- [nio-8080-exec-9] o.s.s.w.a.i.FilterSecurityInterceptor    : Failed to authorize filter invocation [GET /authenticate] with attributes [authenticated]

2022-07-07 15:01:02.650 DEBUG 11690 --- [nio-8080-exec-9] o.s.s.w.s.HttpSessionRequestCache
...


Somehow session ids are invalidated. I also noticed a difference in the http request compared to my working local version. "Connection: close" in my server version whereas Connection is set to "keep-alive" in the local version.
Has anyone encountered the same issue or any ideas why session id is invalidated?
