Comments (2)
Yes. I believe you are correct. This video and app is the ABSOLUTE BEST example I've found for marrying Cognito Federated Identities and Cognito User Pools, but it still has some gaps. But it has way fewer gaps that others (e.g. https://github.com/ionic-team/ionic2-starter-aws).
In the spacefinder app, methods that use Cognito User Pools Authorizer or the Custom Authorizer have no way to know if the user ID from Cognito Federated Identities goes with the claim.
From memory, here's what I did to fix it in my app:
User Pool
- Add custom field "custom:identityId".
- Make the field readable. Making it readable will make it part of jwt id tokens.
Custom Authorizer
- Near the end, JSON.stringify the decoded jwt and put it in the context, so that it's available to functions that use the Custom Authorizer. I put it in .context['custom:authorizer']
IAM
- The lambda execution role needs a couple new permissions.
{
"Action": [
"cognito-idp:AdminGetUser",
"cognito-idp:AdminUpdateUserAttributes"
],
"Resource": [
"arn:aws:cognito-idp:us-east-1:123456789012:userpool/us-east-1_xxxxxxxxx"
],
"Effect": "Allow"
}
New API method
- Create New api method for /user/ UPDATE
- This method uses AWS_IAM Authorizer and accepts an id or session token the request body. That means API Gateway will put the identityId in event.requestContext.identity.cognitoIdentityId, and you can trust that it's valid.
- API gateway did not validate the jwt in the body, so you have to do that yourself. You can borrowing all the code out of the custom authorizer in this sample. If the token valid, use cognito-idp.idp:AdminUpdateUserAttributes to store the identityId in a custom attribute.
Changes to existing API methods
- Now methods that use User Pools Authorizer can get the identityId from event.requestContext.authorizer.claims['custom:identityId']
- Methods that use the Custom Authorizer can get the identityId from (in my case) JSON.parse(event.requestContext.authorizer['custom:authorizer'])['custom:identityId'] (You can't put it the same place that the Cognito User Pools Authorizer uses because API Gateway will barf for no good reason if you put anything other than string, number, boolean in the context).
- But there's one more catch for 1 and 2 above. Right after you set the custom attribute, it won't be on subsequent reads of the token right away. So until it shows up, you need a fall-back to use cognito-idp:AdminGetUser to read it out of the custom attribute. I have no idea if that api call is rate-limited, but it should only be occurring for brand-new users and for a short time.
Changes to ionic app
- On login, if the 'custom:identityId' method is missing, call the new API method /users/ UPDATE to "link" the user.
from aws-serverless-auth-reference-app.
Hi there- To comment on this further, for the sake of time and due to this being a prototype reference app, we did send the userID through the payload without validating it. However, the much better way to do this, which would prevent spoofing is to have the effective IAM policy of the user (either from the IAM role assumed with Cognito Federated Identities or from the IAM policy returned by a custom authorizer with API Gateway) have only allow the user to invoke API operations on their particular user ID as a path parameter. For example, /users/userIdGuid and /users/userIdGuid/*. You can use either the identity ID from Cognito User Pools via an IAM policy variable as we have setup in our IAM policy, or if you're exclusively using Cognito User Pools with Custom Authorizers, use the unique subscriber ID of the user in the user pool.
Then, in the code of your function to do any modifications related to a user, pull the user ID out of the path parameter rather than the body, which is already being enforced via the execution policy so if the function code can even be invoked, you know that the path parameter sent through is that of the valid, actual user (unless an admin is calling operations and you've given them more broad permissions).
Hope this helps clarify a more secure method of validating the user ID. I think this is perhaps the most simple approach to solve this problem and prevent spoofing.
from aws-serverless-auth-reference-app.
Related Issues (20)
- Side menu version HOT 1
- CAN'T CONVERT IONIC TO PWA..!!
- regenerating sdk causes issues HOT 3
- How can you add a second IdP without losing roles logic?
- "Bookings" failed on showing booked resource list-Run in a web browser HOT 1
- Store Login data and auto login
- Tighten Up Lambda Execution Role Policy By Using Policy Variable (identity ID or Subscriber ID) Fine-Grained Access to DynamoDB HOT 5
- Can not connect using putty and ec2-user HOT 6
- Is the user information in account-management.service.ts secure?
- AWSCognito is not defined in account-management.service.ts
- lambda wrapper functions break any Promise returns
- api create_sdk command fails HOT 2
- Token refresh
- Cannot run gulp deploy HOT 2
- Generated Java API SDK has lots of Syntax errors HOT 2
- Could you provide some sample Java code for Cognito UserPool Authorizer client
- Account Image is not persisted
- How can i get my temporary credentials for my federated Id token ? HOT 1
- gulp deploy fails on lambda creation - repo needs to be updated for supported nodejs version HOT 3
- Demo to migrate to AppSync and GraphQL?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aws-serverless-auth-reference-app.