will JWKS for verifying signature of Cognito access token expire?

I am storing the JWK Set for my user pool locally in server and comparing it against the accessToken from cognto to verify the request. I have doubt whether the JWKS have any sort of validity and become void after expiry?

トピック

セキュリティ、アイデンティティ、コンプライアンス

タグ

Amazon Cognito Amazon Cognito ユーザープール

言語

English

IndieGameDeveloperFromParallelWorld

質問済み 7ヶ月前402ビュー

1回答

新しい順
投票が多い順
コメントが多い順

これらの回答は役に立ちましたか？コミュニティがあなたの知識を活用できるように、正解に賛成票を投じてください。

承認された回答

As stated in this page, Amazon Cognito does rotate signing keys. Your local JWK Set will get stale and it won't validate the access token signed with a rorated key in the user pool.

Amazon Cognito might rotate signing keys in your user pool. As a best practice, cache public keys in your app, using the kid as a cache key, and refresh the cache periodically. Compare the kid in the tokens that your app receives to your cache.

回答済み 7ヶ月前

IndieGameDeveloperFromParallelWorld
7ヶ月前
Hi Thanks, In that case, How ofteen should I update the JWKS data?
IndieGameDeveloperFromParallelWorld
7ヶ月前
Hi Thanks, In that case, How ofteen should I update the JWKS data?
HS
7ヶ月前
As stated in the documentation, you need to compare your kid in your local JWK Set with the kid in the token. If they don't match, then AWS should have rotated the key and its the time to refresh the cache. To provide maximum availability, you should compare the kid on every validation.

If you receive a token with the correct issuer but a different kid, Amazon Cognito might have rotated the signing key. Refresh the cache from your user pool jwks_uri endpoint.

will JWKS for verifying signature of Cognito access token expire?

関連するコンテンツ