561 Unauthorized (Load Balancer)

AWS load balancer code logged when an identity provider returned an error during authentication.

Status

HTTP/1.1 561 Unauthorized (Load Balancer)

Details

Category: 5xx
Status: Unofficial (AWS Elastic Load Balancing). Not registered with IANA. A server, framework, or CDN convention.
Specification: none, not defined by any RFC
Cacheable: Not cacheable
Response body: Allowed
Retry: Retry only after changing the request

An Application Load Balancer configured to authenticate users through an identity provider records 561 when the provider returns an error code. The request never reached the target.

It indicates a problem in the OIDC or Cognito configuration rather than in the application behind the load balancer.

Common causes

An identity provider rejected the authentication request.
Misconfigured client id, secret, or callback URL on the listener rule.
An expired or revoked session with the identity provider.

How to fix it

As the client

Re-authenticate from the start of the login flow.

As the server

Check the listener's authenticate action configuration against the identity provider.
Confirm the callback URL registered with the provider matches the load balancer's.

Examples

(ALB access log)
561 - - "GET https://app.example.com/ HTTP/1.1"