CODEWITHSUNDEEP
query-stringamazon-cognito
Big Pumpkin
Big Pumpkin

Reputation: 4487

AWS Cognito hosted UI returning id_token in URL

I am using AWS Cognito's hosted UI for user login. The id token is returned as part of the URL as described in https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-app-integration.html. Namely,

You can find the JSON web token (JWT) identity token after the #idtoken= parameter in the response. Here's a sample response from an implicit grant request. https://www.example.com/#id_token=123456789tokens123456789&expires_in=3600&token_type=Bearer

However, putting sensitive data in a query string is considered a bad practice (Is an HTTPS query string secure?). Does AWS Cognito support a more secure way of returning the id token?

Upvotes: 4

Views: 3591

Answers (1)

Ninad Gaikwad
Ninad Gaikwad

Reputation: 4480

Instead of token you can ask cognito to send you the Authorization code. From Documentation:

The authorization code grant is the preferred method for authorizing end users. Instead of directly providing user pool tokens to an end user upon authentication, an authorization code is provided. This code is then sent to a custom application that can exchange it for the desired tokens. Because the tokens are never exposed directly to an end user, they are less likely to become compromised.

Source: https://aws.amazon.com/blogs/mobile/understanding-amazon-cognito-user-pool-oauth-2-0-grants/

Upvotes: 5

Related Questions