How to verify AWS Cognito Access Token on NodeJS

Question

I found an example on how to verify Cognito access tokens with Python. How do I do the same with NodeJS? Is there no SDK function to do this?

So far I have

authorizeCognitoJwt(token) {
    const COGNITO_POOL_ID = 'ap-southeast-1_xxx'
    const COGNITO_JWT_SET = {
    'keys': [
        {
        'alg': 'RS256',
        'e': 'AQAB',
        'kid': 'ChkV+...=',
        'kty': 'RSA',
        'n': 'tkjexS...johc5Q',
        'use': 'sig'
        },
        {
        'alg': 'RS256',
        'e': 'AQAB',
        'kid': 'Ve...Eb8dw6Y=',
        'kty': 'RSA',
        'n': 'hW19H...0c9Q',
        'use': 'sig'
        }
    ]
    }
    const decodedJwt = jwt.decode(token, {complete: true})
    console.log(decodedJwt)

    if (decodedJwt.payload.iss !== `https://cognito-idp.us-east-1.amazonaws.com/${COGNITO_POOL_ID}`) {
    return 'INVALID_ISSUER'
    }

    if (decodedJwt.payload.token_use !== 'access') {
    return 'INVALID_TOKEN_USE'
    }

    var jwtKey = COGNITO_JWT_SET.keys.find(k => k.kid === decodedJwt.header.kid)
    if (!jwtKey) {
    return 'INVALID_TOKEN_KID'
    }

    var verifiedKey = jwt.verify(token, /* how do I get the key? */)

    return 'VALID'
}

But am stuck at how do I get keys from COGNITO_JWT_SET

Does this answer your question? [How to verify JWT from AWS Cognito in the API backend?](https://stackoverflow.com/questions/40302349/how-to-verify-jwt-from-aws-cognito-in-the-api-backend) — Max Ivanov, Apr 25 '20 at 22:53

Ashan · Accepted Answer · 2017-08-20T05:05:20.507

2

You can get the COGNITO_JWT_SET by using this URL.

Refer the blog post Integrating Amazon Cognito User Pools with API Gateway in AWS Mobile Blog for a complete example with code.

edited Aug 20 '17 at 05:05

answered Aug 20 '17 at 04:59

Ashan

18,898
4
47
67

1

Oh I have those, but I dont know how to use them? See the `jwt.verify` function? How do I verify my token using these? – Jiew Meng Aug 20 '17 at 05:46
Did you check the example link I shared to refer? – Ashan Aug 20 '17 at 06:46
1

How do I convert the keys into PEMs? "you can download it manually once, converting the keys to PEMs and uploading them with your Lambda function" – Jiew Meng Aug 20 '17 at 12:57
Thank you saw the code lower down in the article thank you – Jiew Meng Aug 20 '17 at 13:42

How to verify AWS Cognito Access Token on NodeJS

1 Answers1