Cognito OAuth access token missing "typ" header parameter


The access tokens supplied by Cognito are missing the "typ" header parameter which breaks with the RFC 9068 OAuth2.0 JWT spec. It states that:

"JWT access tokens MUST include this media type in the "typ" header parameter to explicitly declare that the JWT represents an access token complying with this profile."

asked 3 months ago161 views
1 Answer

RFC 9068 was published in October 2021 with these snippets in the Introduction setting the stage for standardization.

The original OAuth 2.0 Authorization Framework [RFC6749] specification does not mandate any specific format for access tokens. [...] This specification aims to provide a standardized and interoperable profile as an alternative to the proprietary JWT access token layouts going forward.

If you need to determine if a token is an access token, Amazon Cognito issued JWTs include a token_use claim as part of the payload with the value access or id (see Using the access token ).

profile pictureAWS
answered 3 months ago
profile picture
reviewed 3 months ago
  • Is there a plan for Cognito to adhere to the JWT spec or will it continue with it's proprietary implementation? It is currently incompatible with tooling that adheres to RFC9068

  • Jon - please contact your AWS account team about Cognito feature roadmap. Share this link and let them know to contact me for additional background.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions