CODEWITHSUNDEEP
restauthenticationjwtamazon-cognito
writes_on
writes_on

Reputation: 1885

What are best practices using AWS Cognito to authenticate a REST API

I'm building a REST API and using AWS Cognito's user pools for authentication. I've got a "get_token" endpoint that returns the JWT access and refresh tokens to the user, which they use to authenticate access to the other REST endpoints provided by the API.

The access token has an expiration timeout. If the user of my API is an application program, what are the best practices for the application to handle when the access token expires? Does the application have to remember the username/password and re-authenticate to continue? Is using the refresh token to get a new access token and use that going forward the best approach?

Is there any documentation, suggestions anyone can point out that might help me out?

Upvotes: 0

Views: 436

Answers (1)

pirox22
pirox22

Reputation: 922

Cognito provides 3 types of tokens, id, access and refresh tokens when you login. The way this usually works is that you send either of the first two (depends on whether you want to be sending user payload information to your backend) to your backend via an Authorization header and verify the token there.

Your id and access tokens usually have a shorter expiration time compared to the refresh token. What you should do is, when the id (or access) token expire, you should use the refresh token to generate a new id (or access) token. When the refresh token expires that means that you can no longer generate new id/access tokens from it. In this case, the user (or app) must login again.

Upvotes: 1

Related Questions