cognitojwt | Decode and verify Amazon Cognito JWT tokens | AWS library

by borisrozumnuk Python Version: 1.4.1 License: Non-SPDX

X-Ray Key Features Code Snippets Community Discussions(1)Vulnerabilities Install Support

kandi X-RAY | cognitojwt Summary

cognitojwt is a Python library typically used in Cloud, AWS, Amazon S3, DynamoDB applications. cognitojwt has no bugs, it has no vulnerabilities, it has build file available and it has low support. However cognitojwt has a Non-SPDX License. You can install using 'pip install cognitojwt' or download it from GitHub, PyPI.

Decode and verify Amazon Cognito JWT tokens

Support

Quality

Security

License

Reuse

Support

cognitojwt has a low active ecosystem.

It has 33 star(s) with 10 fork(s). There are 2 watchers for this library.

It had no major release in the last 12 months.

There are 1 open issues and 2 have been closed. On average issues are closed in 26 days. There are no pull requests.

It has a neutral sentiment in the developer community.

The latest version of cognitojwt is 1.4.1

Quality

cognitojwt has 0 bugs and 0 code smells.

Security

cognitojwt has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

cognitojwt code analysis shows 0 unresolved vulnerabilities.

There are 0 security hotspots that need review.

License

cognitojwt has a Non-SPDX License.

Non-SPDX licenses can be open source with a non SPDX compliant license, or non open source licenses, and you need to review them closely before use.

Reuse

cognitojwt releases are not available. You will need to build from source code and install.

Deployable package is available in PyPI.

Build file is available. You can build the component from source.

Installation instructions, examples and code snippets are available.

cognitojwt saves you 154 person hours of effort in developing the same functionality from scratch.

It has 384 lines of code, 26 functions and 10 files.

It has high code complexity. Code complexity directly impacts maintainability of the code.

Top functions reviewed by kandi - BETA

kandi has reviewed cognitojwt and discovered the below as its top functions. This is intended to give you an instant insight into cognitojwt implemented functionality, and help decide if they suit your requirements.

Decodes a token asynchronously
Builds the public key from the given token
Ensure that the token_use token_use is valid
Get a list of keys
Check if token is expired
Get unverified headers
Get unverified claims from a JWT
Verify token signature
Construct the public key from the given token
Returns a list of keys from the server

Get all kandi verified functions for this library.

cognitojwt Key Features

No Key Features are available at this moment for cognitojwt.

cognitojwt Examples and Code Snippets

No Code Snippets are available at this moment for cognitojwt.

Community Discussions

Trending Discussions on cognitojwt

How mobile app and web server communicates if AWS Cognito is added in between

QUESTION

How mobile app and web server communicates if AWS Cognito is added in between

Asked 2020-May-07 at 08:58

My mobile App currently performs SSO using following steps

User will select one of the IDP from the list on the Mobile APP and click Login
Mobile App will instenciate in-app browser control and navigate to SSO URL
If not already authenticated IDP challenges user for authentication
User will be presented with the login form to enter his/her credentials.
Once user is authenticated successfully by IDP, the SAML Assertion will be passed to Web Server
Web Server trusts IDP, accepts SML token and generates Session token
Mobile Browser component accepts the session token and share it with native mobile app
Mobile App calls web server APIs with this session token

Now due to security reasons Session token is not advisable to be stored on Mobile Device, whereas OIDC or JWT tokens can be stored

As my Web Application does not support generating OIDC tokens so I thought of adding one more layer of AWS Cognito in between my mobile device and IDP. Now the authentication flow will be like (SAML User Pool IdP Authentication flow)

The mobile app starts the sign-in process by directing the user to the UI hosted by AWS.
User is redirected to the identity provider.
The IdP authenticates the user if necessary. If the IdP recognizes that the user has an active session, the IdP skips the authentication to provide a single sign-in (SSO) experience.
The IdP POSTs the SAML assertion to the Amazon Cognito service.
After verifying the SAML assertion and collecting the user attributes (claims) from the assertion, Amazon Cognito returns OIDC tokens to the mobile app for the now signed-in user.

Now my question is once I have OIDC token, how mobile App will call my web server for any API calls? Is it through Cognito? Direct call to my web server will not work as it does not understand the OIDC token returned by Cognito? How I can achieve this communication from Mobile App to my Web server?

UPDATE: I was able to validate the JWT token from my web server issued by Cognito. If anyone else is looking to do the same then they can refer this cognitojwt library (not written by me just found it on internet)

...

ANSWER

Answered 2020-Apr-07 at 10:44

OIDC tokens returned by Cognito are ID Token and Access Token, both are JWT. You can pass these to your custom backend directly (most commonly in Authorization header).

On the backend you should decode and verify the token using your user pool's public key (JWK). JWK is available at https://cognito-idp.{region}.amazonaws.com/{userPoolId}/.well-known/jwks.json. If token is valid and not expired, you can trust it and use it for custom backend authorization logic.

The whole process of verifying tokens is described here https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-verifying-a-jwt.html and there are a number of open source libraries which will help you do that.

Source https://stackoverflow.com/questions/61073852

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install cognitojwt

Package works in two modes: synchronous - requests as http-client and asynchronous - aiohttp as http-client. In order to avoid installing unnecessary dependencies I separated installation flow into two modes:.
Async mode - pip install cognitojwt[async]
Sync mode - pip install cognitojwt[sync]

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: