I am using Amazon Congito's Hosted UI. The redirect uri I set is:
https://example.com/redirect_endpoint
But, that endpoint is authenticated. So, I want the hosted UI to send the id_token to that redirect URI as part of its Authorization header
Is there a way to tell AWS Cognito's hosted UI to send that id_token as part of its Authorization header? In other words, can I make the redirect_uri authenticated?
You can use the implicit grant flow, the id and access tokens will be sent as query parameters. So, if the authentication of the authenticated uri is in your control you can read tokens from query string. You can set it under userpool/app client settings/ oauth 2.0.
option 1 - redirect to a common page or a home page and then call the authenticated uri from there. In this case you can use the authorization grant flow which is more secure and recommended approach from aws.
option 2 - using custom lambda authorizer for the api gateway and select lambda event payload as REQUEST. Now you can pass the query string token to lambda authorizer where you can check its signature and expiry