I'm using the following technology stack for my web application
- CloudFront as a Proxy and CDN
- S3 orign to CloudFront to serve AngularJS application
- APIGateway origin to CloudFront for REST API
- Cognito UserPools with CognitoAuthorizer for authentication in API Gateway
To store Web Application user session, I usually stores the issued JWT from Cognito in a Client-Side Cookie, HTML5 LocalStorage or SessionStorage.
However I'm curious to know that CloudFront Signed Cookies can provide a session state for the Web Applications. I'm hoping to use Signed Cookies to store JWT and use Edge Lambda to map a Signed Cookie to Authorization Header to authenticate API Gateway. I'm interested to know
- Is using CloudFront Signed Cookies to store JWT will work?
- Is it a good approach to store session state in Signed Cookies for web applications?
- If so, what are the best practices around it? I'm not sure using Edge Lambda is the right approach.