AWS Cognito Accepting Any Password

Question

I am implementing AWS with an Android application for the first time.

We would like to use Cognito to authenticate our users, and selectively provide data from DynamoDB.

I have successfully set up my user pool and can see new registrations appear in the user list. Trying to login with an email that does not exist fails.

However, Cognito always logs in with a valid email address, regardless of password input.

What is wrong with my process?

public class CognitoController extends Application {
    static CognitoUserPool pool;
    static String userEmail;
    public void onCreate(){
        super.onCreate();
        pool = new CognitoUserPool(this,
                "us-east-xxxx",
                "xxxx",
                "xxxx",
                new ClientConfiguration(),
                Regions.US_EAST_1);
    }
}

-

private void actionAdminLogin(){
        UtilityInterfaceTools.hideSoftKeyboard(AdminLoginActivity.this);
        String inputEmail = ((EditText) findViewById(R.id.input_admin_email)).getText().toString();
        String inputPassword = ((EditText) findViewById(R.id.input_admin_password)).getText().toString();
        CognitoController.userEmail = inputEmail;
        details = new AuthenticationDetails(inputEmail, inputPassword, null);

        AuthenticationHandler auther = new AuthenticationHandler() {
            @Override
            public void onSuccess(CognitoUserSession userSession, CognitoDevice newDevice) {
                Toast.makeText(AdminLoginActivity.this, "Congratulations It Works...", Toast.LENGTH_LONG).show();
                startActivity(new Intent(AdminLoginActivity.this, AdminPortalActivity.class));
                finish();
            }

            @Override
            public void getAuthenticationDetails(AuthenticationContinuation continuation, String email) {
                continuation.setAuthenticationDetails(details);
                continuation.continueTask();
            }

            @Override
            public void getMFACode(MultiFactorAuthenticationContinuation continuation) {
                continuation.continueTask();
            }

            @Override
            public void authenticationChallenge(ChallengeContinuation continuation) {
                continuation.continueTask();
            }

            @Override
            public void onFailure(Exception exception) {
                TextView errorMessage = findViewById(R.id.message_invalid_credentials);
                errorMessage.setText(exception.toString());
                errorMessage.setVisibility(View.VISIBLE);
            }
        };
        CognitoController.pool.getUser(inputEmail).getSessionInBackground(auther);
    }

o-0 o-0 · Accepted Answer · 2018-10-15T07:47:02

I think your problem (which is not a problem by the way) is either:

In your pool Cognito setting, you chose your devices to be remembered.

Remembered

devices are also tracked. During user authentication, the key and secret pair assigned to a remembered device is used to authenticate the device to verify that it is the same device that the user previously used to sign in to the application. APIs to see remembered devices have been added to new releases of the Android, iOS, and JavaScript SDKs. You can also see remembered devices from the Amazon Cognito console.

The token is already cached:

Caching

The Mobile SDK for Android caches the last successfully authenticated user and the user's tokens locally on the device, in SharedPreferences. The SDK also provides methods to get the last successfully authenticated user.

Your Application Update

In fact for better user experience, you want the user to use the app, and don't need to login every time that she wants to use your app (e.g., look at mail apps, social media apps, etc.). However, you application need to handle that, you have two choices here:

Redirect to login if necessary: If the user is already logged in and wants to use the application again, your app needs to verify the user against the Cognito user pool, and only then, redirect the user to the login page if necessary.
Remove the token: If you really want the user to login every time that she uses the application, then remove the token if the user signs out; but I do not recommend this, for the sake of user experience.

AWS Cognito Accepting Any Password

1 Answers