Cognito OAuth access token missing "typ" header parameter

Question

The access tokens supplied by Cognito are missing the "typ" header parameter which breaks with the RFC 9068 OAuth2.0 JWT spec. It states that:

"JWT access tokens MUST include this media type in the "typ" header parameter to explicitly declare that the JWT represents an access token complying with this profile."

Answer

RFC 9068 was published in October 2021 with these snippets in the Introduction setting the stage for standardization.

> The original OAuth 2.0 Authorization Framework [RFC6749] specification does not mandate any specific format for access tokens.
> [...]
> This specification aims to provide a standardized and interoperable profile as an alternative to the proprietary JWT access token layouts going forward.

If you need to determine if a token is an access token, Amazon Cognito issued JWTs include a `token_use` claim as part of the payload with the value `access` or `id` (see [Using the access token](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-access-token.html) ).

Cognito OAuth access token missing "typ" header parameter

Relevanter Inhalt