- Newest
- Most votes
- Most comments
Using the hash fragment of the URL is related to the OpenID Connect Core 1.0 standard section 3.2.2.5. Successful Authentication Response
When using the Implicit Flow, all response parameters are added to the fragment component of the Redirection URI
Advice under 3.2.2.7. Redirect URI Fragment Handling is:
Since response parameters are returned in the Redirection URI fragment value, the Client needs to have the User Agent parse the fragment encoded values and pass them to on to the Client's processing logic for consumption.
Are you redirecting from Cognito directly to API Gateway?
However, per Amazon Cognito - Authorize endpoint "An implicit grant is less secure because it exposes tokens and potential identifying information to users" and it is more secure to use an authorization code grant. The code is returned in the query string parameters and not in the fragment.
HI
we are trying to redirecting from Cognito directly to API Gateway, which show us {"message":"Unauthorized"} not sure what we are doing wrong
Thanks Siddharth
This is not possible to do it directly, you need something between cognito and api gateway to parse the toke or token from code and pass it again to the api gateway via Authorization header
Relevant content
- asked 2 years ago
- asked 2 years ago
- asked 8 months ago
AWS OFFICIALUpdated 3 years ago- AWS OFFICIALUpdated a year ago
- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated a year ago
Yes I wanted to redirect from Congito to ApiGateway directly, but couldn't get hold of the token on the Http ApiGateway side not via QueryString nor via the Authorization header even as it wasn't getting populated also. What I ended up doing is build a small client that I redirect from Cognito, the parses the token and then do request to ApiGateway with token as QueryString value. It doesn't sound smart but that's all what I'm left with!
Beware that tokens are credentials, and show up in access logs when on Query String, and could be used to make additional requests. See https://aws.amazon.com/blogs/mobile/understanding-amazon-cognito-user-pool-oauth-2-0-grants/ about the authorization code grant which can be exchanged for the desired tokens based on a code_challenge. Can you do this code for token exchange in your API Gateway logic?
Yes, I'm aware of that, the whole solution was simple about a lambda displaying some html response, there is not much security concern about it. At the end to get a token needs a valid credentials and if someone is able to get access to access logs to get the token that means they are authorized otherwise it's a different problem.