Should refresh_auth validate the nonce hmac? about cloudfront-authorization-at-edge

[ottokruse]

I think you are right and have spotted a place where we could (should) also use nonce signing.

Some context to understand how important this is:

• Using nonces is an OAuth recommended practice
• Signing the nonces is a security-in-depth measure (that we added later, after launching this Auth@Edge sample solution)

By signing the nonce, we can be sure that we were the ones creating them. That should make it super duper hard for other (malicious) websites to redirect you halfway into the auth-flow. Even without signing it's gonna be a tough trick for the other websites to "inject" a nonce cookie to begin with.

Do you maybe want to collaborate on the project and add the nonce signing & verification to the refresh auth flow?

[RLuckom]

I'm too busy to take that on right now but if that changes I'll let you know!