Cognito Security notification

Question

We recently received Cognito Security notification: any assertions sent to Cognito in response to an authentication request with an assertion ID that has been used in the past, or without an assertion ID, will be rejected, which may cause disruption to your application.

We understand this is a bad practice and are working towards to fix the issue (it's a third party IdP).

I'm wondering if there is a way on Cognito side to allow re-using of the assertions IDs for a couple of extra months?

Answer

Hi,
As you noted this a bad practice and therefore it would be a security issue to allow it. Unfortunately we cannot make this exception as it would not respect our part of the shared responsibility model.
Jeff

Cognito Security notification

相关内容