AWS cognito: Cognito access token doc: wording and typo fixes
Summary
Minor copyedits in the Amazon Cognito access token documentation: 'JSON Web Token' changed to 'JSON web token', 'browsers cookies' corrected to 'browser cookies', and 'intended to authorize for' changed to 'intended to authorize'. No substantive technical or security content changed.
Security assessment
The only changes are capitalization, a grammar fix ('browsers cookies' -> 'browser cookies'), and removal of a stray 'for'. The pre-existing security guidance about verifying token signatures is unchanged, so this edit neither fixes a vulnerability nor adds new security documentation.
Evidence
+The access token is a [JSON web token (JWT)](https://www.rfc-editor.org/rfc/rfc7519). The header for the access token has the same structure as the ID token. Amazon Cognito signs access tokens with a different key from the key that signs ID tokens. The value of an access key ID (`kid`) claim won't match the value of the `kid` claim in an ID token from the same user session. In your app code, verify ID tokens and access tokens independently. Don't trust the claims in an access token until you verify the signature. For more information, see [Verifying JSON web tokens](./amazon-cognito-user-pools-using-tokens-verifying-a-jwt.html). You can set the access token expiration to any value between 5 minutes and 1 day. You can set this value per app client.
Diff
diff --git a/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-access-token.md b/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-access-token.md index 3ac28bd..0e23555 100644 --- a//cognito/latest/developerguide/amazon-cognito-user-pools-using-the-access-token.md +++ b//cognito/latest/developerguide/amazon-cognito-user-pools-using-the-access-token.md @@ -21 +21 @@ A user's access token with the `aws.cognito.signin.user.admin` scope is permissi -The access token is a [JSON Web Token (JWT)](https://www.rfc-editor.org/rfc/rfc7519). The header for the access token has the same structure as the ID token. Amazon Cognito signs access tokens with a different key from the key that signs ID tokens. The value of an access key ID (`kid`) claim won't match the value of the `kid` claim in an ID token from the same user session. In your app code, verify ID tokens and access tokens independently. Don't trust the claims in an access token until you verify the signature. For more information, see [Verifying JSON web tokens](./amazon-cognito-user-pools-using-tokens-verifying-a-jwt.html). You can set the access token expiration to any value between 5 minutes and 1 day. You can set this value per app client. +The access token is a [JSON web token (JWT)](https://www.rfc-editor.org/rfc/rfc7519). The header for the access token has the same structure as the ID token. Amazon Cognito signs access tokens with a different key from the key that signs ID tokens. The value of an access key ID (`kid`) claim won't match the value of the `kid` claim in an ID token from the same user session. In your app code, verify ID tokens and access tokens independently. Don't trust the claims in an access token until you verify the signature. For more information, see [Verifying JSON web tokens](./amazon-cognito-user-pools-using-tokens-verifying-a-jwt.html). You can set the access token expiration to any value between 5 minutes and 1 day. You can set this value per app client. @@ -25 +25 @@ The access token is a [JSON Web Token (JWT)](https://www.rfc-editor.org/rfc/rfc7 -For access and ID tokens, don't specify a minimum less than an hour if you use managed login. Managed login sets browsers cookies that are valid for one hour. If you configure an access token duration of less than an hour, this has no effect on the validity of the managed login cookie and users' ability to reauthenticate without additional credentials for one hour after initial sign-in. +For access and ID tokens, don't specify a minimum less than an hour if you use managed login. Managed login sets browser cookies that are valid for one hour. If you configure an access token duration of less than an hour, this has no effect on the validity of the managed login cookie and users' ability to reauthenticate without additional credentials for one hour after initial sign-in. @@ -112 +112 @@ The user pool app client that authenticated your user. Amazon Cognito renders th -The URL of the API that the access token is intended to authorize for. Present only if your application requested a [resource binding](./cognito-user-pools-define-resource-servers.html#cognito-user-pools-resource-binding) from your authorization server. +The URL of the API that the access token is intended to authorize. Present only if your application requested a [resource binding](./cognito-user-pools-define-resource-servers.html#cognito-user-pools-resource-binding) from your authorization server.