Collaborate Disseminate
I am developing an application where users need to provide an API key to a 3rd party service, our app (a serverless app on AWS with a dynamo db) then makes requests to that 3rd party service on behalf of the user. Users are authenticated … Continue reading 3rd Party API Key in cognito custom attribute JWT
I’m building a public HTTP JSON API using API Gateway with ID token authentication.
I now need a server that acts on behalf of users. Users message that server using a third party (think Signal or WhatsApp) and the server calls some API me… Continue reading OAuth2/Cognito: Let trusted server act on behalf of user
As more of our lives move online, we expect identity fraud attempts to continue apace. Fortunately, technology is still one step ahead. While some trends may seem bleak, there are straightforward and convenient ways to thwart identity thieves. NFT mark… Continue reading Major trends in online identity verification for 2022
Cognito launched Cognito Flow, a global identity verification and compliance system. Cognito Flow provides the full stack of online verification requirements for global business customers, including scanning and verifying passport and driver’s license … Continue reading Cognito Flow offers online verification requirements for global business customers
I have a requirement to offer an Open ID Connect Identity Provider server.
(That is, i have some users with their credentials checked against some data store under my control, and users are using those to access applications offered by oth… Continue reading Can I Use AWS Cognito to protect external service, not AWS hosted service
We are setting up an authentication system using Cognito and Amplify. We noticed that Amplify suggests Secure Remote Password as the default.
I can understand the benefits of SRP for protecting against man-in-the-middle and such attacks. B… Continue reading Pros vs Cons of Secure Remote Password
I have been unable to find a definitive answer to the above question.
We currently use JWTs from AWS Cognito for our Authentication. Currently the JWTs that are returned are too large to use in Cookies (over the 4KB limit) so we do not … Continue reading Should JWT’s be validated on every request?
Server-based apps check for a session cookie before returning any content to the user. If an authentication cookie isn’t sent from the user’s browser, the only content delivered to the user is a redirect/error message.
I’m n… Continue reading Serverless Apps Authenticate Users After Page Load – Flaw?
Am doing a pen test on a client system using AWS Cognito and userpools for authentication using the client side SDK provided by AWS.
during the forget password flow, I noticed that Cognito request returns 400 with a payload … Continue reading Is detecting if an email has an account considered a vulnerability with AWS cognito?
I am working on migrating all our users from our DB to a managed service, and we’re considering AWS Cognito.
We want to use Cognito for Authentication and Access Control.
For access control, we’re thinking about putting the user claims in… Continue reading Using Cognito access token to pass claims