AWS cognito medium security documentation change
Summary
Added security note about 'sub' claim format validation
Security assessment
Addresses potential security vulnerabilities from strict UUID validation by explicitly warning against format validation of the 'sub' claim
Diff
diff --git a/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-id-token.md b/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-id-token.md index b005b9cc7..9e0cbe3ce 100644 --- a//cognito/latest/developerguide/amazon-cognito-user-pools-using-the-id-token.md +++ b//cognito/latest/developerguide/amazon-cognito-user-pools-using-the-id-token.md @@ -90,0 +91,4 @@ A unique identifier ([UUID](./cognito-terms.html#terms-uuid)), or subject, for t +###### Important + +Amazon Cognito generates `sub` in an Amazon Cognito-specific format that doesn't conform to a specific UUID format, including RFC UUID. You shouldn't strictly validate the format of `sub`. +