Ensure AWS Cognito client pool client authentication on a static Internet

Question

From the AWS documentation ( Specifying Application Settings for a User Pool ):

It is the responsibility of the developer to protect any application client identifiers or secrets, so that only authorized client applications can API without authentication.

So, is there any scheme for authenticating in a secure environment (without showing the client ID clearly on a static Internet).

AWS samples set the client identifier explicitly, so it does not comply with the doc recommendation. Also, any attacker can carry out brute force attacks against an unauthorized api cognito with a static web client identifier. Is there any way to avoid this?

Answer 1

Their recommendation applies when you use both the client ID of the application and the secret (usually in mobile development).

When you create an application, you can optionally create a secret for this application. If a secret is created for an application, the secret must be for using the application. Browser-based applications written in JavaScript may not need a secret application.

When you use Cognito on the Internet, you do not need to generate a secret (uncheck the box when creating an application in your user pool). This really leaves the application client identifier in clear text on the client, but there is no additional risk for this scenario than for the login page to be open to the Internet: an attacker can try to force your login independently.

What I'm sure Amazon does in this case (this is what people should do in the case of user logic anyway) protects against throttled requests, IP blacklists, etc., which significantly slows down attackers to the point where it’s impossible or not worth making brutal attacks.

In short, you don’t have to worry about leaving the application client ID embedded in your web interface code.

Hope this helps!