By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Cognito OAuth access token missing "typ" header parameter

0

The access tokens supplied by Cognito are missing the "typ" header parameter which breaks with the RFC 9068 OAuth2.0 JWT spec. It states that:

"JWT access tokens MUST include this media type in the "typ" header parameter to explicitly declare that the JWT represents an access token complying with this profile."

Topics
Security, Identity, & Compliance
Tags
Amazon Cognito
Language
English
Jon
asked a month ago122 views
1 Answer
0

RFC 9068 was published in October 2021 with these snippets in the Introduction setting the stage for standardization.

The original OAuth 2.0 Authorization Framework [RFC6749] specification does not mandate any specific format for access tokens. [...] This specification aims to provide a standardized and interoperable profile as an alternative to the proprietary JWT access token layouts going forward.

If you need to determine if a token is an access token, Amazon Cognito issued JWTs include a token_use claim as part of the payload with the value access or id (see Using the access token ).

profile pictureAWS
hakanson
answered a month ago
profile picture
EXPERT
Osvaldo Marte
reviewed a month ago
  • Jon
    a month ago

    Is there a plan for Cognito to adhere to the JWT spec or will it continue with it's proprietary implementation? It is currently incompatible with tooling that adheres to RFC9068

  • hakanson
    a month ago

    Jon - please contact your AWS account team about Cognito feature roadmap. Share this link and let them know to contact me for additional background.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content