AWS Cognito refreshing tokens against a different user pool also returns valid tokens

up vote
1
down vote

favorite

I was trying the AWS CLI for cognito.

I have a refresh token issued by user pool, let's say "A" with client ID "clientA".

I used this against a different user pool "B" in the same region. I specified client ID as "clientA" instead of B's own. This command worked and returned new access and ID tokens successfully.

$  aws cognito-idp admin-initiate-auth --user-pool-id "B" 

--region eu-west-1 --client-id clientA --auth-flow 

REFRESH_TOKEN_AUTH --auth-parameters "REFRESH_TOKEN=<refresh-token-from-A>"

It seems like AWS Cognito does not really use the "user-pool-id" parameter and only considers the client ID. Or otherwise this is a security loophole.

asked Nov 8 at 11:15

Deepthi

836

add a comment |

up vote
1
down vote

favorite

I was trying the AWS CLI for cognito.

I have a refresh token issued by user pool, let's say "A" with client ID "clientA".

I used this against a different user pool "B" in the same region. I specified client ID as "clientA" instead of B's own. This command worked and returned new access and ID tokens successfully.

$  aws cognito-idp admin-initiate-auth --user-pool-id "B" 

--region eu-west-1 --client-id clientA --auth-flow 

REFRESH_TOKEN_AUTH --auth-parameters "REFRESH_TOKEN=<refresh-token-from-A>"

It seems like AWS Cognito does not really use the "user-pool-id" parameter and only considers the client ID. Or otherwise this is a security loophole.

asked Nov 8 at 11:15

Deepthi

836

add a comment |

up vote
1
down vote

favorite

I was trying the AWS CLI for cognito.

I have a refresh token issued by user pool, let's say "A" with client ID "clientA".

I used this against a different user pool "B" in the same region. I specified client ID as "clientA" instead of B's own. This command worked and returned new access and ID tokens successfully.

$  aws cognito-idp admin-initiate-auth --user-pool-id "B" 

--region eu-west-1 --client-id clientA --auth-flow 

REFRESH_TOKEN_AUTH --auth-parameters "REFRESH_TOKEN=<refresh-token-from-A>"

It seems like AWS Cognito does not really use the "user-pool-id" parameter and only considers the client ID. Or otherwise this is a security loophole.

asked Nov 8 at 11:15

Deepthi

836

I was trying the AWS CLI for cognito.

I have a refresh token issued by user pool, let's say "A" with client ID "clientA".

I used this against a different user pool "B" in the same region. I specified client ID as "clientA" instead of B's own. This command worked and returned new access and ID tokens successfully.

$  aws cognito-idp admin-initiate-auth --user-pool-id "B" 

--region eu-west-1 --client-id clientA --auth-flow 

REFRESH_TOKEN_AUTH --auth-parameters "REFRESH_TOKEN=<refresh-token-from-A>"

It seems like AWS Cognito does not really use the "user-pool-id" parameter and only considers the client ID. Or otherwise this is a security loophole.

amazon-web-services security amazon-cognito

asked Nov 8 at 11:15

Deepthi

836

asked Nov 8 at 11:15

Deepthi

836

asked Nov 8 at 11:15

Deepthi

836

asked Nov 8 at 11:15

Deepthi

836

asked Nov 8 at 11:15

Deepthi

836

add a comment |

1 Answer
1

active

oldest

votes

up vote
2
down vote

accepted

The documentation isn't massively clear about this, but the REFRESH_TOKEN flow does not use the client-id or user-pool-id as these are effectively provided by the Refresh Token itself. (Although the body won't validate without them...)

If you do some further commands on the CLI you'll see that the tokens you got back from that command only allow you to act as the originally issued client-id/user-pool-id.

edited Nov 9 at 9:20

answered Nov 8 at 15:27

thomasmichaelwallace

2,040816

add a comment |

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53206629%2faws-cognito-refreshing-tokens-against-a-different-user-pool-also-returns-valid-t%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

up vote
2
down vote

accepted

If you do some further commands on the CLI you'll see that the tokens you got back from that command only allow you to act as the originally issued client-id/user-pool-id.

edited Nov 9 at 9:20

answered Nov 8 at 15:27

thomasmichaelwallace

2,040816

add a comment |

up vote
2
down vote

accepted

If you do some further commands on the CLI you'll see that the tokens you got back from that command only allow you to act as the originally issued client-id/user-pool-id.

edited Nov 9 at 9:20

answered Nov 8 at 15:27

thomasmichaelwallace

2,040816

add a comment |

up vote
2
down vote

accepted

If you do some further commands on the CLI you'll see that the tokens you got back from that command only allow you to act as the originally issued client-id/user-pool-id.

edited Nov 9 at 9:20

answered Nov 8 at 15:27

thomasmichaelwallace

2,040816

If you do some further commands on the CLI you'll see that the tokens you got back from that command only allow you to act as the originally issued client-id/user-pool-id.

edited Nov 9 at 9:20

answered Nov 8 at 15:27

thomasmichaelwallace

2,040816

edited Nov 9 at 9:20

answered Nov 8 at 15:27

thomasmichaelwallace

2,040816

answered Nov 8 at 15:27

thomasmichaelwallace

2,040816

answered Nov 8 at 15:27

thomasmichaelwallace

2,040816

add a comment |

draft saved

draft discarded

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Agfdhyk