Okta Access Gateway Returns a 400 Status Code with a Plain HTTP Error
Last Updated:
Overview
A 400 Bad Request error occurs when accessing Okta Access Gateway (OAG) applications behind a load balancer that terminates Secure Sockets Layer (SSL). Resolve this issue, caused by sending a plain HTTP request to port 443, by configuring the front-end load balancer to send only HTTPS traffic to OAG on port 443. When this error occurs, Okta displays the following error message.
400 Bad Request - The plain HTTP request was sent to HTTPS port - Access Gateway
Review the following example of the 400 Bad Request error page.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta Access Gateway (OAG)
Cause
Okta Access Gateway only accepts secure HTTPS traffic on port 443. If a load balancer sends a plain HTTP request on port 80, Okta redirects the request to HTTPS on port 443 via a 301 redirect response. However, if a load balancer sends a plain HTTP request on port 443, Okta displays the 400 Bad Request error page.
Solution
How is the 400 Bad Request error resolved?
Configure the front-end load balancer to avoid terminating Secure Sockets Layer (SSL) and send only HTTPS traffic to Okta Access Gateway on port 443.
NOTE: Traffic between the Okta Access Gateway and the backend application can use plain HTTP by configuring the application's protected web resource URL accordingly.
