AWS cognito high security documentation change
Summary
Strengthened token verification requirements: changed audience verification from optional to mandatory and replaced 'should' with 'must' for audience/issuer claims.
Security assessment
Explicitly requiring audience (aud) and issuer (iss) claim verification addresses potential token substitution vulnerabilities. Changing from optional to mandatory reflects critical security controls to prevent token misuse. Specific evidence: code comment changed from 'Optional' to 'you must verify' and normative language strengthened for claim validation.
Diff
diff --git a/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-verifying-a-jwt.md b/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-verifying-a-jwt.md index 16e7cf277..02ca6d5ab 100644 --- a//cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-verifying-a-jwt.md +++ b//cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-verifying-a-jwt.md @@ -109 +109 @@ The following example application verifies user pool tokens with `aws-jwt-verify - clientId: '1example23456789', // Optional, only if you need to verify the token audience + clientId: '1example23456789', // you must verify the token audience @@ -221 +221 @@ The `use` parameter describes the intended use of the public key. For this examp - 2. The `aud` claim in an ID token and the `client_id` claim in an access token should match the app client ID that was created in the Amazon Cognito user pool. + 2. The `aud` claim in an ID token and the `client_id` claim in an access token must match the app client ID that was created in the Amazon Cognito user pool. @@ -223 +223 @@ The `use` parameter describes the intended use of the public key. For this examp - 3. The issuer (`iss`) claim should match your user pool. For example, a user pool created in the `us-east-1` Region will have the following `iss` value: + 3. The issuer (`iss`) claim must match your user pool. For example, a user pool created in the `us-east-1` Region will have the following `iss` value: