Safe to authenticate with userId supplied in Amazon Alexa request?

1
votes

I want to record some persistent details/history against each device/userId. I don't want to link with a separate account in another system so I want to avoid using account linking. Docs suggest this is fine, see below.

Is it safe to assume that any request which includes the userId must be from the original device?

  • Can userId be guessed?
  • Can userId be exposed? (Assuming no major AWS intrusion)
  • Can requests be intercepted? (I am using AWS Lambda to handle requests)

Related Docs: https://developer.amazon.com/public/solutions/alexa/alexa-skills-kit/docs/linking-an-alexa-user-with-a-user-in-your-system

Note that account linking is needed when the skill needs to connect with a system that requires authentication. If yourcustom skill just needs to keep track of a user to save attributes between sessions, you do not need to use account linking. Instead, you can use the userId provided in each request to identify the user. The userId for a given user is generated when the user enables your skill in the Alexa app. Every subsequent request from that user to your skill contains the same userId unless the user disables the skill.

1
amazon-web-servicesalexa-skills-kitalexa-skill

1 Answers

0
votes

I don't think there is any way to id device's (you write "device/userId") so yes, you would be using userId, and it is pretty standard to use the Alexa userId as a key to store/lookup a users' details/history. And as you have concluded it doesn't sound like you need account linking.

I would assume that userId is a randomly generated value that can't be guessed, and requests are encrypted so there shouldn't be a problem there.

I believe I read that, if a user removes your skill and then adds it again then the userId is not the same (so you have no way to know that it is actually the same user without using account linking). My point in mentioning that is that it leads me to assume that the user does not have a single userId for all their skills (which I think would qualify as 'exposing' the userId), but rather a new userId is generated for each skill. So you should be safe.