Why would Strapi admin fail to login when site domain go through CloudFront CDN?

When we point our domain to CloudFront that proxies requests to our server, we cannot log in to admin anymore, when we type email and password, then click the submit button, it first seems like log-in was successful, then it redirects back to the login page. The only error shown in the console is 401 for the following pages:

/information
/permissions
/me

When we make the domain point directly to our server, we then can log in with no issues. In all cases, we use Nginx which passes requests to the actual Strapi server through proxy_pass.

Are there any settings we need to tweak on Strapi? Or are there any headers/settings that need to be added to the CDN service?

Strapi is almost vanilla, other than the URL, models, and db settings, there aren't any actual customizations.

Any suggestions?

I had the same issue and I solved it by modifying the headers forwarding policy in Cloud Front:

1. Go to your distribution
2. Go to Behaviors and click edit
3. Scroll down to Cache key and origin requests section
4. Choose Cache policy and origin request policy (recommended)
5. For Cache policy choose CachingDIsabled (it is managed one)
6. For Origin request policy - optional click on Create origin request policy to create a custom one
7. Create the following policy:
8. Refresh the options for Origin request policy - optional and choose the newly created policy
9. Save the changes
10. Wait for CloudFront to be deployed

Obviously, Cloud Front is not including all headers from the origin request which is causing the issue. I hope this solves your problem also.