AWS cognito: Document acr and amr claims in Cognito ID token
Summary
Adds a note that the ID token includes acr and amr claims describing the authentication level and methods completed, linking to step-up authentication docs.
Security assessment
Documents authentication context claims (acr/amr) that applications can use to enforce authentication strength; security-relevant documentation, not a fix.
Evidence
+The ID token includes the `acr` and `amr` claims, which describe the authentication level that the user satisfied and the methods that they completed. For more information, see [ACR and AMR token claims](./cognito-user-pools-step-up-authentication.html#cognito-user-pools-step-up-token-claims).
Diff
diff --git a/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-id-token.md b/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-id-token.md index 3e52418..82c5db2 100644 --- a//cognito/latest/developerguide/amazon-cognito-user-pools-using-the-id-token.md +++ b//cognito/latest/developerguide/amazon-cognito-user-pools-using-the-id-token.md @@ -14,0 +15,2 @@ You can set the ID token expiration to any value between 5 minutes and 1 day. Yo +The ID token includes the `acr` and `amr` claims, which describe the authentication level that the user satisfied and the methods that they completed. For more information, see [ACR and AMR token claims](./cognito-user-pools-step-up-authentication.html#cognito-user-pools-step-up-token-claims). +