AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
Cognito - unable to reset password with no phone number added
Hi,
I stumbled upon an issue recently (noticed it 1-2 days ago, before everything was fine) where users from my Cognito pool cannot go thru password recovery flow.
In my application users are created by admin (admin_create_user(...) from boto3 python package), there is no self sign-up.
Whenever a user wants to reset a password, it shows following message:
The affected user has no phone number added, but has an e-mail and it's verified. According to the error message it should be sufficient - user has to have a verified email OR phone_number - this condition is met. I made a test and I added a fake phone number to the affected user directly in Cognito, I just put a value "+111" - did not set it to verified, and the problem was gone. I can reset a password for user and user can do it on it's own. This problem recently started to affect only users who chose Authenticator App as MFA and were not forced to provide a phone number.
"Delivery method for user account recovery messages" setting for my user pool is set to "Email only".
This looks like either a bug was introduced or requirements have changed but in that case error message is inaccurate. Please let me know is this a problem on Cognito side or am I missing something - I don't want to force users to provide a phone number if it's not necessary.
- Newest
- Most votes
- Most comments
I'm encountering exactly the same issue: the email is verified for the user and it has the 2MFA email activated. The password can't be force reseted by the admin API call in this case. If the 2MFA is deactivated, then the password can be reseted. I think this is a bug.
answered a year ago
Based on the information provided, it appears you're experiencing an issue with Amazon Cognito's password reset functionality for users without phone numbers. This situation seems to be inconsistent with the expected behavior of Cognito's account recovery process.
Typically, Amazon Cognito should be able to send a password reset code to a user's verified email address if they don't have a verified phone number. The error message you're seeing suggests that either a verified email or phone number should be sufficient for password recovery.
The fact that adding an unverified phone number resolves the issue is unusual and not in line with Cognito's standard behavior. Normally, Cognito prioritizes verified communication channels for security reasons.
This behavior could potentially be due to a recent change or bug in the Cognito service. It's worth noting that Cognito's account recovery settings can be configured to prioritize certain recovery methods. By default, if no specific setting is provided, Cognito attempts to send the recovery code to a verified phone number first, and then to a verified email if a phone number isn't available.
To address this issue, you could try the following:
-
Check your user pool's account recovery settings to ensure email is included as a recovery mechanism.
-
Verify that the affected users indeed have verified email addresses in your user pool.
-
If possible, temporarily configure your account recovery settings to prioritize email over phone number and see if that resolves the issue.
-
If the problem persists, it would be advisable to contact AWS Support, as this behavior seems inconsistent with Cognito's documented functionality.
Remember, forcing users to provide a phone number should not be necessary if they have a verified email address, based on Cognito's standard functionality. The situation you're describing appears to be anomalous and may require further investigation by AWS.
Sources
AWS cognito Forgot password both mail and sms | AWS re:Post
Passwords, account recovery, and password policies - Amazon Cognito
ForgotPassword - Amazon Cognito User Pools
Relevant content
asked a year ago
asked 2 years ago
- AWS OFFICIALUpdated 10 months ago
- AWS OFFICIALUpdated 4 years ago
- AWS OFFICIALUpdated a year ago
- AWS OFFICIALUpdated 4 years ago
I'm also experiencing the same thing.
Same thing here. This used to work, now even in the console GUI it throws the same error.