AWS cognito: Access token claims are additive; link to safe token parsing guide
Summary
Adds a note that access tokens carry claims additively like ID tokens and that the same parsing rules apply, linking to the new 'Parse user pool tokens safely' page; also renames the navigation entry from 'Refresh tokens' to 'Parse tokens safely'.
Security assessment
The added text warns that access token claim sets are not fixed and directs readers to safe parsing guidance, which reduces the risk of applications making authorization decisions on assumed-but-absent claims. It is general hardening guidance, not tied to a specific vulnerability or incident.
Evidence
+The access token carries claims additively, the same way the ID token does, and the same parsing rules apply. For more information about parsing tokens safely, see [Parse user pool tokens safely](./user-pool-parse-tokens-safely.html).
Diff
diff --git a/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-access-token.md b/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-access-token.md index f7061b9..3ac28bd 100644 --- a//cognito/latest/developerguide/amazon-cognito-user-pools-using-the-access-token.md +++ b//cognito/latest/developerguide/amazon-cognito-user-pools-using-the-access-token.md @@ -26,0 +27,2 @@ For access and ID tokens, don't specify a minimum less than an hour if you use m +The access token carries claims additively, the same way the ID token does, and the same parsing rules apply. For more information about parsing tokens safely, see [Parse user pool tokens safely](./user-pool-parse-tokens-safely.html). + @@ -186 +188 @@ ID tokens -Refresh tokens +Parse tokens safely