Questions tagged [aws-cognito]
The aws-cognito tag has no usage guidance.
4
questions
1
vote
1answer
74 views
Why is ID token used instead of Access token to get temporary credentials in AWS?
After a user logons to cognito, he receives access and ID tokens. the ID token contains sensitive info like phone number, email, etc..
From all standards - ID token should not be used to gain access ...
2
votes
0answers
98 views
Does my app need authentication in addition to Spotify authorization?
I have an app that revolves entirely around Spotify. I have followed the authorization guide from Spotify and am using the Authorization Code Flow so the access token can be refreshed. My thinking was ...
0
votes
0answers
41 views
Is it correct to use AWS Cognito groups as user roles?
I trying to implement authN/authZ for my application using Spring Security 5.2.2 and OAuth2/openid connect protocols. I use AWS Cognito as an identity provider and I'm trying to implement role-based ...
3
votes
1answer
150 views
What is the use case of request signing in this mobile app?
The API of a mobile app I was testing is sending the AWS AccessKeyId and SecretKey used for request signing from the AWS Cognito server unencrypted (apart from the regular TLS encryption). Making it ...
