How to verify accessToken in node/express using aws-amplify?

Unfortunately, there is no such method available in official aws-amplify SDK. After doing a lot of research I had to write my own middleware for that. This is not that difficult as it may seem but the only difficult part is to gather the right information from the huge AWS documentation.

I 've written this middleware to achieve the same, Hope this helps

import axios from 'axios'
import awsconfig from '../../aws-exports';

const COGNITO_URL = `https://cognito-idp.${awsconfig.aws_project_region}.amazonaws.com/`;

const authentication = async (req, res, next) => {
    try {
        const accessToken = req.headers.authorization.split(" ")[1];

        const { data } = await axios.post(
            COGNITO_URL,
            {
                AccessToken: accessToken
            },
            {
                headers: {
                    "Content-Type": "application/x-amz-json-1.1",
                    "X-Amz-Target": "AWSCognitoIdentityProviderService.GetUser"
                }
            }
        )

        req.user = data;
        next();
    } catch (error) {
        return res.status(401).json({
            message: 'Auth failed'
        });
    }
};

export default authentication;

This middleware takes the authorization header and verifies the incoming accessToken using AWS Cognito REST API.

In order to get accessToken on your front-end you can do something like this:

const { accessToken: { jwtToken } } = await Auth.currentSession();

This jwtToken is your accessToken you can send this in your Authorization header and then verify this in the backend using the middleware I've written.

AWS actually has this documented pretty well. I have written a gist on a middleware I wrote to validate AWS Cognito tokens in my express.js server.

Essentially, when you create a User Pool in Amazon, AWS creates a JSON Web Key (JWK). The JWT contains a public key you can use to verify the signature of a JWT.

At a high level in Javascript:

import jwt from "jsonwebtoken";

const authToken = getJwtFromHeader(request);

// please remember to verify the "iss" claim and "exp" claim!
validateAuthToken(authToken);

// convert a jwk to a PEM for use by OpenSSL or crypto
const jwk = getJwkFromAWS();
const pem = jwkToPem(jwk);

// verify the signature of the token using the public key from AWS
await jwt.verify(authToken, pem, {algorithms: ['RS256']}, (err, decoded) =>{
  console.log('decoded', decoded);
  // TODO -- verify claims from decoded token
}); 

My GIST for a full express.js implementation: https://gist.github.com/fourgates/92dc769468497863168417c3524e24dd

AWS Resources:

https://github.com/awslabs/aws-support-tools/tree/master/Cognito/decode-verify-jwt https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-verifying-a-jwt.html

Unfortunately, the aws-amplify SDK doesn't provide that functionality. For that reason, I've created an npm package to handle it.

How it works

The package exposes:

• authenticate: An Express middleware that can be added to any route that needs to be authenticated against a Cognito User Pool.
• authenticationError: An Express error handler that takes care of any authentication errors generated by the authenticate middleware.
• JWTValidator: A class that can be instantiated to validate JWTs issued by Cognito. This is useful if you need a custom authentication and error handling logic. The authenticate middleware uses it internally.

Features included

• JWT signature verification.
• JWT claims verification.
• Verify that the token is not expired.
• Verify that the audience (aud) claim matches one of the valid audiences provided in the configuration.
• Verify that the issuer (iss) claim is valid for the configured user pool.
• Verify that the token_use claim matches one of the valid token uses provided in the configuration.
• Support for JWKs rotation as per described in the JWT signing key rotation thread.
• Ability to set custom pems for local testing without the need of creating a User Pool.

Basic usage

// app.js
'use strict';

const express = require('express');
const { authenticate, authenticationError } = require('aws-cognito-express');

const app = express();

// Add the authentication middleware.
app.use(authenticate({
  region: 'us-east-2',
  userPoolId: 'us-east-2_6IfDT7ZUq',
  tokenUse: ['id', 'access'],
  audience: ['55plsi2cl0o267lfusmgaf67pf']
}));

// Protected route.
app.get('/articles', (req, res, next) => {
  console.log('JWT payload: ', req.cognito);
});

// Add the authentication error handler.
app.use(authenticationError());

module.exports = app;

For more advanced use cases, please check the docs here.

Since 17 September 2021, we now have this repository (and associated npm package):

• https://github.com/awslabs/aws-jwt-verify
• https://www.npmjs.com/package/aws-jwt-verify

This allows us (external node applications, usually server side web facing applications) to verify JWTs signed by AWS, such as those emitted from AWS cognito.

Specifically, as the tokens are asymmetrically signed, this verified AWS account publisher of the node package refers to the AWS published JSON Web Key Set (JWKS), promoting a degree of trust in the code we use to verify the claims contained in JWTs as they may be presented as bearer tokens to our apps.

The sample code taken from: https://github.com/awslabs/aws-jwt-verify#express (in this case it uses express) appears to be quite user-friendly as well:

import express, { Request } from 'express';
import { CognitoJwtVerifier } from 'aws-jwt-verify';


const cognitoJWTVerifier = CognitoJwtVerifier.create({
  userPoolId: 'your-user-pool-id', // mandatory, can't be overridden upon calling verify
  tokenUse: 'access',
  clientId: 'your-client-id',
});


app.get('/authenticated/route', async (req: Request & { verifiedCognitoJWT?: any }, res, next) => {
  try {
    const verifiedCognitoJWT = await cognitoJWTVerifier.verify(`${req.header('authorization')}`);
    req.verifiedCognitoJWT = verifiedCognitoJWT;

    next();
  } catch (e) {
    return res.status(401).json({ statusCode: 401, message: 'Unauthorized' });
  }
}, getAuthenticatedRoute);

Note that you can optionally call hydrate() to pre-fetch the JWKS before your app begins listening for HTTP connections, but omitting this call just delays the first call to verify() which lazily fetches them.

And of course this example can be extended with proper typings, or built into a middleware etc. as required.