dosubot[bot] commented on issue #34159: URL: https://github.com/apache/superset/issues/34159#issuecomment-3070138204
<!-- Greeting --> Hi @marcocharlie! I'm [Dosu](https://go.dosu.dev/dosubot) and Iām helping the superset team. <!-- Answer --> This kind of intermittent "Connection aborted" error during OAuth with Keycloak is not unique, especially in setups involving Kubernetes, Nginx, and AWS ALB. Based on Superset's code and similar reports, this usually points to network instability or proxy/load balancer configuration rather than a Superset or Flask AppBuilder bug. Superset does not retry failed OAuth HTTP requests, so any transient network hiccup between Superset and Keycloak (or an intermediary like Nginx/ALB) will cause the error you see, but a retry often works. A few things to check and try: - Make sure your ALB, Nginx, and Kubernetes timeouts are all higher than Superset's `SUPERSET_WEBSERVER_TIMEOUT` (default is 60s). If the proxy or ALB closes connections early, you'll see these errors. See the config note [here](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py). - For proxy headers, try setting `PROXY_FIX_CONFIG = {"x_proto": 1, "x_host": 1, "x_prefix": 1, "x_port": 0}`. The `"x_port": 0` is important if you have SSL termination at the load balancer or proxy, as it prevents port mismatches in the OAuth flow [reference](https://github.com/apache/superset/discussions/32047). - If possible, test with an NGINX ingress controller instead of AWS ALB. Some users have found that switching to NGINX ingress resolves similar intermittent issues with redirects and OAuth [reference](https://github.com/apache/superset/discussions/31584). - Double-check that all your `redirect_uri` values in both Superset and Keycloak exactly match, including protocol and port. - If you have cross-domain or HTTPS, set `SESSION_COOKIE_SECURE = True` and consider `SESSION_COOKIE_SAMESITE = "None"` if you see cookie/session issues. - If the problem persists, try to capture network traces or increase logging on both Superset and Keycloak to see if the disconnect is happening at the proxy, ALB, or Keycloak itself. There are no recent code changes or open issues in Superset that directly address this specific error. The pattern and code suggest it's almost always a network or proxy config issue in these environments. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/bb86e999-98c1-4893-85d9-02e62993f940?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/bb86e999-98c1-4893-85d9-02e62993f940?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/bb86e999-98c1-4893-85d9-02e62993f940?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/bb86e999-98c1-4893-85d9-02e62993f940?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/bb86e999-98c1-4893-85d9-02e62993f940?feedback_type=hallucination) | [Report š](https://app.dosu.dev/response-feedback/bb86e999-98c1-4893-85d9-02e62993f940?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/bb86e999-98c1-4893-85d9-02e62993f940?feedback_type=other)</sup> [](https://go.dosu.dev/discord-bot) [! [Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/34159) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
