CODEWITHSUNDEEP
amazon-web-servicesamazon-cognito
027
027

Reputation: 1661

Where should be code for for getting Cognito token (frontend side or backend side)

I have application which has frontend code in angular. This frontend application calls backend APIs(spring-boot).

I have deployed this in EKS behind Application Load Balancer(ALB)

Request flow: Route53 -> ALB -> Frontend Target Group or Backend Target Group.

I want to setup AWS Cognito at ALB for user authentication. I am going to federate user pool from my active directory. I want to allow only those users to login into website with username/password. I want to make sure backend APIs can only be called with valid login/token.

Questions: What grant type should be used? (Authorization code grant/implicit grant/client credentials)

Where should I have code to get token from cognito? In frontend(angular) or backend?

Do I need to secure backend APIs, like APIs can be called with token only? Or Just securing angular route is enough? (because backend points are not visible from outside of cluster, they can be called only from frontend PODs) For example, We can keep mywebsite/login allowed without token, any other pages (mywebsite/serach, mywebsite/home, mywebsite/product) allowed only if token is presented

Upvotes: 0

Views: 846

Answers (1)

Andrew Gillis
Andrew Gillis

Reputation: 3895

Your angular frontend should initiate the flow using authorization code grant. The Cognito Identity SDK has some useful helpers for this but you can use any OIDC client SDK such as AppAuth.

Upvotes: 1

Related Questions