AWS Cognito for standard token based authentication

Question

I have read this question AWS Cognito for API token authentication, but my question is about the User Pool functionality that AWS Cognito launched in May 2016.

Desired Use Case:

I have a Node.js backend and a client-side web app (Polymer), and would like to use Cognito to simplify my token based authentication system.

I would like to use this library for user authentication by having them register and authenticate on the client and storing the access token AWS gives me, then for all future requests to the Node.js backend, sending the access token in the header. I was hoping that the backend could check with Cognito whether the access token is associated with a valid session, and get a user id if so. However, I see no such method for checking an access token against Cognito.

Is there any way I can accomplish this?

Here is a general idea of the flow I am envisioning in code:

// client
cognitoUser.authenticateUser(authenticationDetails, {
    onSuccess: function (result) {
        setCookie('access-token', result.getAccessToken().getJWT())
    },



// client
function fetchData() {
   ajax.request('/server/data',
   headers: {
    token: getCookie('access-token')
   })
}



// node server
get('/data', function(req, res) {
   AWSCognito.validateAccessToken(req.headers.token).then(function(userId)    {
    // if user id exists, this is a valid token. now have user id, can     look them up in database 
    // and do stuff
   }
})

By 'a valid session' do you mean that you want to check if the user is currently logged in on another device? Or do you just want to verify that the user is who he says he is? — PijusV

Rachit Dhall Rachit Dhall · Accepted Answer · 2017-02-13T04:53:36

If you want to verify the identity of the user, you should just validate the id token issued by Cognito in your backend.

AWS Cognito for standard token based authentication

1 Answers