Examkin

Question

Difficulty: MediumApplication Authentication and Authorization with Amazon Cognito

A developer is deploying a containerized Node.js backend application to Amazon ECS on AWS Fargate. The application exposes REST APIs to a web portal where users authenticate using an Amazon Cognito User Pool. The client applications send the JSON Web Token (JWT) access token in the HTTP Authorization header of their requests. The developer needs to implement middleware in the Node.js application to validate these tokens locally, ensuring authenticity without making an external network call to Cognito for every incoming API request. Which approach should the developer take to meet these requirements?

  1. A
    Exchange the user pool access token for temporary AWS credentials using a Cognito Identity Pool on every request, and use the credentials to authenticate the session.
  2. Download the JSON Web Key Set (JWKS) from the Cognito User Pool endpoint and cache it. For each request, verify the token signature using the cached keys, and validate the token expiration and issuer claims.Answer
  3. C
    Configure the Node.js middleware to invoke a Lambda Authorizer function via the AWS SDK, passing the token to validate it against the user pool client credentials.
  4. D
    Configure the IAM trust policy of the ECS Task Execution Role to trust the Cognito User Pool, allowing the container to automatically validate the token signature.

Answer

Download the JSON Web Key Set (JWKS) from the Cognito User Pool endpoint and cache it. For each request, verify the token signature using the cached keys, and validate the token expiration and issuer claims.
Verifying the token locally requires downloading the JSON Web Key Set (JWKS) from the Cognito User Pool endpoint, caching it, and using the public keys to verify the token signature and validate the claims locally without making network calls on every request.

Step-by-Step Solution

1
Download and cache the JSON Web Key Set (JWKS) from the Cognito User Pool's public well-known endpoint.
The application obtains the public keys used by the User Pool to sign JWTs.
This allows the application to perform local cryptographic signature checks without calling Cognito on every request.
2
Extract the JWT from the HTTP Authorization header and match the key ID ('kid') header claim against the cached JWKS.
The corresponding public key is identified for signature validation.
This ensures the correct cryptographic key is used to verify the signature.
3
Verify the signature and validate claims including the expiration time ('exp') and issuer ('iss') against the Cognito User Pool URL.
The token is confirmed to be authentic, untampered, and currently active.
This completes the validation flow locally.

Key Concept

Local validation of Cognito JWT access tokens using the JSON Web Key Set (JWKS).
Estimated Time:1m 30s
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic