Questions tagged [cognito]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
31 views

Can I Use AWS Cognito to protect external service, not AWS hosted service

I have a requirement to offer an Open ID Connect Identity Provider server. (That is, i have some users with their credentials checked against some data store under my control, and users are using ...
2
votes
3answers
134 views

Pros vs Cons of Secure Remote Password

We are setting up an authentication system using Cognito and Amplify. We noticed that Amplify suggests Secure Remote Password as the default. I can understand the benefits of SRP for protecting ...
4
votes
1answer
1k views

Should JWT's be validated on every request?

I have been unable to find a definitive answer to the above question. We currently use JWTs from AWS Cognito for our Authentication. Currently the JWTs that are returned are too large to use in ...
1
vote
0answers
255 views

AWS Appsync authorization - why is IAM authorization safer than API Key based approach

We are currently evaluating which authorization type to use for our production AppSync APIs. As per AWS docs(https://docs.aws.amazon.com/appsync/latest/devguide/security.html, https://aws.amazon.com/...
1
vote
2answers
58 views

Serverless Apps Authenticate Users After Page Load - Flaw?

Server-based apps check for a session cookie before returning any content to the user. If an authentication cookie isn't sent from the user's browser, the only content delivered to the user is a ...
0
votes
1answer
358 views

Is detecting if an email has an account considered a vulnerability with AWS cognito?

Am doing a pen test on a client system using AWS Cognito and userpools for authentication using the client side SDK provided by AWS. during the forget password flow, I noticed that Cognito request ...
2
votes
1answer
895 views

Using Cognito access token to pass claims

I am working on migrating all our users from our DB to a managed service, and we're considering AWS Cognito. We want to use Cognito for Authentication and Access Control. For access control, we're ...
1
vote
1answer
2k views

Is this the correct way to use AWS Cognito?

I am doing the following in my React/Node App: Using the User Pools for a Cognito App that I have created Calling the /login endpoint with response_type=token in my React App Once I receive the JWT ...