What should I use as Cognito's UserContextData => EncodedData?

Viewed 1177

In all AWS Cognito SDKs in most functions you can pass an UserContextData parameter to feed Cognito's Advanced Security feature:

$result = $client->forgotPassword([
  'AnalyticsMetadata' => [
    'AnalyticsEndpointId' => '<string>',
  ],
  'ClientId' => '<string>', // REQUIRED
  'SecretHash' => '<string>',
  'UserContextData' => [  // <=================== THIS
    'EncodedData' => '<string>',
  ],
  'Username' => '<string>', // REQUIRED
]);  

This field expects some EncodedData.

What should I put in UserContextData and how do I "encode" it?

When using an Admin* function like AdminInitiateAuth I can send unencoded fingerprinting data through ContextData:

$result = $client->adminInitiateAuth([
    [...]
    'ContextData' => [
        'EncodedData' => '<string>',
        'HttpHeaders' => [ // REQUIRED
            [
                'headerName' => '<string>',
                'headerValue' => '<string>',
            ],
            // ...
        ],
        'IpAddress' => '<string>', // REQUIRED
        'ServerName' => '<string>', // REQUIRED
        'ServerPath' => '<string>', // REQUIRED
    ],
    [...]
]);

The documentation does not help:
enter image description here

1 Answers

AWS provides an opaque implementation for user context data.

encodedData is to be collected on device and not the server.

The Cognito Javascript client SDK exposes a method to achieve this. It is provided for in the Amplify Android SDK

You can get transfer encodedData from client to server, then forward that in your request to Cognito.

Related