AWS cognito documentation change
Summary
Added note about InvalidParameterException response for password-reset attempts without valid recovery method
Security assessment
Documents security-related error handling for MFA/password recovery workflows without evidence of addressing a specific vulnerability
Diff
diff --git a/cognito/latest/developerguide/user-pool-settings-mfa.md b/cognito/latest/developerguide/user-pool-settings-mfa.md index ebaa06468..64d8596b5 100644 --- a//cognito/latest/developerguide/user-pool-settings-mfa.md +++ b//cognito/latest/developerguide/user-pool-settings-mfa.md @@ -67,0 +68,2 @@ Your [password recovery](./managing-users-passwords.html#user-pool-password-rese +Amazon Cognito replies to password-reset requests from users who don't have a valid recovery method with an `InvalidParameterException` error response. +