A developer is deploying a containerized Node.js backend application to Amazon ECS on AWS Fargate. The application exposes REST APIs to a web portal where users authenticate using an Amazon Cognito User Pool. The client applications send the JSON Web Token (JWT) access token in the HTTP Authorization header of their requests. The developer needs to implement middleware in the Node.js application to validate these tokens locally, ensuring authenticity without making an external network call to Cognito for every incoming API request. Which approach should the developer take to meet these requirements?
- AExchange the user pool access token for temporary AWS credentials using a Cognito Identity Pool on every request, and use the credentials to authenticate the session.
- Download the JSON Web Key Set (JWKS) from the Cognito User Pool endpoint and cache it. For each request, verify the token signature using the cached keys, and validate the token expiration and issuer claims.Cevap
- CConfigure the Node.js middleware to invoke a Lambda Authorizer function via the AWS SDK, passing the token to validate it against the user pool client credentials.
- DConfigure the IAM trust policy of the ECS Task Execution Role to trust the Cognito User Pool, allowing the container to automatically validate the token signature.
Cevap
Download the JSON Web Key Set (JWKS) from the Cognito User Pool endpoint and cache it. For each request, verify the token signature using the cached keys, and validate the token expiration and issuer claims.
Verifying the token locally requires downloading the JSON Web Key Set (JWKS) from the Cognito User Pool endpoint, caching it, and using the public keys to verify the token signature and validate the claims locally without making network calls on every request.
Adım Adım Çözüm
Anahtar Kavram
Local validation of Cognito JWT access tokens using the JSON Web Key Set (JWKS).
Tahmini Süre:1m 30s