Usando AWS re:Post, accetti AWS re:Post Termini di utilizzo
AWS re:Postre:Post

Signing requests with Cognito token to API Gateway necessary?

0

I have an application that uses Cognito for authentication. I also use API Gateway. I read here that

The AWS SDKs, AWS Command Line Interface (AWS CLI), and other AWS tools sign API requests for you using the access key that you specify when you configure the tool. When you use these tools, you don’t need to learn how to sign API requests

So if I'm making fetch requests to API Gateway, is it still necessary to manually sign these requests with the tokens from Cognito? Or is there a way around that?

Argomenti
ServerlessFront-end web e dispositivi mobiliNetworking e distribuzione di contenutiSicurezza, identità e conformità
Tag
Gateway API di AmazonAmazon Cognito
Lingua
English
AWS-User-6117969
posta 2 anni fa711 visualizzazioni
1 Risposta
2

No, when using API Gateway with a Cognito authorizer it is not needed. The token should just be placed in the Authorization header. Signing is used when calling AWS APIs or when using the IAM Authorizer in API Gateway. The signing is done using a mechanism called SigV4.

profile pictureAWS
ESPERTO
Uri
con risposta 2 anni fa
  • AWS-User-6117969
    2 anni fa

    Which token should be used? I noticed that the access token does not have a "sub" field for identifying the user.

  • Uri ESPERTO
    2 anni fa

    You can use an ID token or an Access token.

Accesso non effettuato. Accedi per postare una risposta.

Una buona risposta soddisfa chiaramente la domanda, fornisce un feedback costruttivo e incoraggia la crescita professionale del richiedente.

Linee guida per rispondere alle domande

Contenuto pertinente