DPoP support for AWS Cognito

Question

Hi,

I would like to inquire if there are any plans to provide support for Demonstration of Proof-of-Possession (DPoP) in AWS Cognito in the near future. DPoP, as outlined in RFC 9449 (https://datatracker.ietf.org/doc/html/rfc9449), is a mechanism that binds tokens to a client and helps mitigate replay attacks due to token theft.

I came across a discussion on AWS RePost (https://repost.aws/questions/QUrC0PfIHeReaquMToeGUxGw/how-to-implement-dpop-or-other-proof-of-possession-techniques-for-aws-cognito) that suggests potential workarounds for implementing proof-of-possession mechanisms in Cognito. After exploring the recommendations, I was able to use the Pre Token Generation Lambda trigger to add custom claims to tokens. However, I could not retrieve the DPoP proof from the HTTP request header within the trigger. Since the DPoP proof is essential for generating DPoP-bound access tokens, this limitation prevents me from implementing the mechanism effectively.

Would AWS consider:
1) Introducing native DPoP support in Cognito to enable secure token binding?
2) Exposing request headers, such as the DPoP proof, in Lambda triggers like Pre Token Generation?

These enhancements would greatly facilitate secure sender-constrained token implementation in applications using AWS Cognito. If there are any alternative workarounds or solutions anyone can recommend, I would appreciate your guidance.

re:Post Agent · Answer

Currently, Amazon Cognito does not natively support Demonstration of Proof-of-Possession (DPoP) as outlined in RFC 9449. While Cognito offers various security features and customization options, direct implementation of DPoP is not available at this time.

Cognito does provide some flexibility for custom authentication flows using AWS Lambda functions. You can use Lambda triggers to customize certain aspects of the authentication process, including adding custom claims to tokens through the Pre Token Generation Lambda trigger. However, as you've discovered, there are limitations to this approach, particularly in accessing HTTP request headers like the DPoP proof within these triggers.

For implementing proof-of-possession mechanisms or enhancing token security, Cognito offers other features such as:

1. Custom authentication flows using Lambda functions to implement challenge-response cycles.
2. Multi-factor authentication (MFA) for additional security.
3. Risk-based adaptive authentication to analyze sign-in attempts and prompt for additional verification when necessary.

While these features don't directly replicate DPoP functionality, they can be used to enhance the security of your authentication process.

Regarding future plans for DPoP support or exposing request headers in Lambda triggers, AWS doesn't typically announce feature roadmaps publicly. The best approach would be to submit a feature request to AWS support or through your account representative to express interest in these enhancements.

In the meantime, you might consider implementing additional security measures at the application level to compensate for the lack of native DPoP support. This could include techniques like using short-lived tokens, implementing robust token revocation mechanisms, or adding additional custom claims to your tokens that your application can validate.  
**Sources**  
[Features | Amazon Cognito | Amazon Web Services (AWS)](https://aws.amazon.com/cognito/features/)  
[Cognito support for verification code configuration | AWS re:Post](https://repost.aws/questions/QUi5cxac2SSQuk06vVz3cJpQ/cognito-support-for-verification-code-configuration)

DPoP support for AWS Cognito

Add your answer

Relevant content