AWS cognito medium security documentation change
Summary
Added security note about 'sub' claim format validation
Security assessment
Addresses potential security vulnerabilities from strict UUID validation by explicitly warning against format validation of the 'sub' claim
Diff
diff --git a/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-access-token.md b/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-access-token.md index f78aa85e0..ea71b280b 100644 --- a//cognito/latest/developerguide/amazon-cognito-user-pools-using-the-access-token.md +++ b//cognito/latest/developerguide/amazon-cognito-user-pools-using-the-access-token.md @@ -83,0 +84,4 @@ A unique identifier ([UUID](./cognito-terms.html#terms-uuid)), or subject, for t +###### Important + +Amazon Cognito generates `sub` in an Amazon Cognito-specific format that doesn't conform to a specific UUID format, including RFC UUID. You shouldn't strictly validate the format of `sub`. +