Access Token expires when using AWS Load Balancer with OIDC and Keycloak – Nginx

We run the following setup:

• AWS Load Balancer (ALB) with Listener configured to authenticate requests via OIDC. Our OIDC Server is Keycloak
• When authentication completed, the request is forwarded to our nginx, acting as Reverse Proxy.
• Frontends are stored in AWS S3 and proxied through the nginx.

This work as expected (fine).

Our problem occurs when calling our backend services from the Webbrowser.

For example:

setInterval(() => {
    var xhr = new XMLHttpRequest();
    xhr.open('GET', 'https://our-backend-api-via.reverse.proxy.com');
    xhr.send();
}, 1000);

This works fine until the AccessToken is expired (60s). Then our backend will see that the token is expired and returns HTTP 401 for multiple times.. after a while (20 seconds) a new AccessToken is received and the backends responses fine.

The process of getting new accessToken via AWS ALB seems to be a blackbox for us, we cannot explain why expired accessTokens are send to our backends, shouldn’t the AWS ALB renew the token in time?