Questions tagged [aws-cognito]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
5
votes
2answers
263 views

What is the use case of request signing in this mobile app?

The API of a mobile app I was testing is sending the AWS AccessKeyId and SecretKey used for request signing from the AWS Cognito server unencrypted (apart from the regular TLS encryption). Making it ...
0
votes
0answers
31 views

Can I Use AWS Cognito to protect external service, not AWS hosted service

I have a requirement to offer an Open ID Connect Identity Provider server. (That is, i have some users with their credentials checked against some data store under my control, and users are using ...
0
votes
0answers
44 views

Rest Services Aunthentication and Authorization with AWS Cognito

I am designing the authentication and authorization flow of my mobile and web applications. I plan to use the AWS Cognito identity provider. Use AWS Amplify and signup the user from the front-end. ...
1
vote
1answer
227 views

Why is ID token used instead of Access token to get temporary credentials in AWS?

After a user logons to cognito, he receives access and ID tokens. the ID token contains sensitive info like phone number, email, etc.. From all standards - ID token should not be used to gain access ...
1
vote
0answers
52 views

Using AWS Cognito or Firebase Auth can help to certify my app with ISO 27001?

My colleague told me that ISO 27001 require physical server running in the office to store user password. Therefore, using AWS Cognito or Firebase Auth can save us the physical server since they have ...
1
vote
0answers
140 views

Why doesn't Keycloak allow user sign-up and sign-in through a client?

I'm in need of an authentication & authorization service that can manage our app's pool of users. I stumbled upon Keycloak and have been checking it for the past few days, but I'm wondering why ...
2
votes
0answers
193 views

Does my app need authentication in addition to Spotify authorization?

I have an app that revolves entirely around Spotify. I have followed the authorization guide from Spotify and am using the Authorization Code Flow so the access token can be refreshed. My thinking was ...
1
vote
0answers
805 views

Is it correct to use AWS Cognito groups as user roles?

I trying to implement authN/authZ for my application using Spring Security 5.2.2 and OAuth2/openid connect protocols. I use AWS Cognito as an identity provider and I'm trying to implement role-based ...