Questions tagged [cognito]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
3
votes
1answer
185 views

Should JWT's be validated on every request?

I have been unable to find a definitive answer to the above question. We currently use JWTs from AWS Cognito for our Authentication. Currently the JWTs that are returned are too large to use in ...
1
vote
0answers
99 views

AWS Appsync authorization - why is IAM authorization safer than API Key based approach

We are currently evaluating which authorization type to use for our production AppSync APIs. As per AWS docs(https://docs.aws.amazon.com/appsync/latest/devguide/security.html, https://aws.amazon.com/...
1
vote
2answers
57 views

Serverless Apps Authenticate Users After Page Load - Flaw?

Server-based apps check for a session cookie before returning any content to the user. If an authentication cookie isn't sent from the user's browser, the only content delivered to the user is a ...
0
votes
1answer
209 views

Is detecting if an email has an account considered a vulnerability with AWS cognito?

Am doing a pen test on a client system using AWS Cognito and userpools for authentication using the client side SDK provided by AWS. during the forget password flow, I noticed that Cognito request ...
1
vote
0answers
445 views

Using Cognito access token to pass claims

I am working on migrating all our users from our DB to a managed service, and we're considering AWS Cognito. We want to use Cognito for Authentication and Access Control. For access control, we're ...
1
vote
1answer
2k views

Is this the correct way to use AWS Cognito?

I am doing the following in my React/Node App: Using the User Pools for a Cognito App that I have created Calling the /login endpoint with response_type=token in my React App Once I receive the JWT ...