AWS cognito: Grammar fix in Cognito domain prefix guidance
Summary
Corrects 'a authentication domain' to 'an authentication domain' in the comparison between prefix and custom domains. No substantive security content change.
Security assessment
The change is a single article correction ('a' to 'an') in prose about domain trust; it does not alter security guidance or address a vulnerability.
Evidence
The default experience for managed login is hosted on a domain that AWS owns. This approach has a low barrier to entry—choose a prefix name and it's active—but doesn't have the trust-inspiring features of a custom domain. There isn't a cost difference between the Amazon Cognito domain option and the custom domain option. The only difference is the domain in the web address that you direct your users to. For cases of third-party IdP redirects and client-credentials flows, the prefix domain has little visible effect. A custom domain is better for cases where your users sign in with managed login and would interact with an authentication domain that doesn't match the application domain.
Diff
diff --git a/cognito/latest/developerguide/cognito-user-pools-assign-domain-prefix.md b/cognito/latest/developerguide/cognito-user-pools-assign-domain-prefix.md index 30ecbfd..ca6d46a 100644 --- a//cognito/latest/developerguide/cognito-user-pools-assign-domain-prefix.md +++ b//cognito/latest/developerguide/cognito-user-pools-assign-domain-prefix.md @@ -11 +11 @@ PrerequisitesConfigure an Amazon Cognito domain prefixVerify your sign-in page -The default experience for managed login is hosted on a domain that AWS owns. This approach has a low barrier to entry—choose a prefix name and it's active—but doesn't have the trust-inspiring features of a custom domain. There isn't a cost difference between the Amazon Cognito domain option and the custom domain option. The only difference is the domain in the web address that you direct your users to. For cases of third-party IdP redirects and client-credentials flows, the prefix domain has little visible effect. A custom domain is better for cases where your users sign in with managed login and would interact with a authentication domain that doesn't match the application domain. +The default experience for managed login is hosted on a domain that AWS owns. This approach has a low barrier to entry—choose a prefix name and it's active—but doesn't have the trust-inspiring features of a custom domain. There isn't a cost difference between the Amazon Cognito domain option and the custom domain option. The only difference is the domain in the web address that you direct your users to. For cases of third-party IdP redirects and client-credentials flows, the prefix domain has little visible effect. A custom domain is better for cases where your users sign in with managed login and would interact with an authentication domain that doesn't match the application domain.