Tutorial: How to add security to a REST API using JWT Authorizers and Amazon Cognito | JWT Token

A quick tutorial on how to secure your AWS REST APIs using AWS Cognito, JWT Tokens, and JWT Authorizers. We will have the API Gateway setup with JWT Authorizers that will verify each api request has a valid JWT Token. These tokens will be generated from AWS Cognito for an authenticated user.

Topics covered:

1) Simple Lambda Creation using Nodejs
2) Cognito User Pool Creation
3) API Gateway Authorizer - JWT Authorizer

[TPDene]

Thanks a lot! That's exactly what we need. We want to use Amazon S3 with an existing Keycloak instance and use JWT Token authentification

[Notrious]

You saved the day! I had t use oauth 2.0 in postman and not the bearer token dropdown

[kouroshbaghaei]

Thanks a lot! Very concise and to the point! 👌

[jumboliah]

Great video. Great content and well executed and straightforward. Well done.

[PrashantZombade]

Great content, very helpful video. Thanks for your efforts.

[nimishgoray]

The AWS Cognito interface has changed, the setup is very different from what's shown in this video.

[ajaygulani]

Great video! So how does it all work on the front end? using JaveScript how does one use the host UI and retrieve the token and store and use it?

[Visgapn]

I have implemented Cognito authentication for my .net web api / react app. It's in .net 4.8 framework and hosted in iis localhost. Also using IIS Url rewrite to configure IIS that react router handlea the app navigations after authentication is completed.
Issue is when we make Cognito logout api endpoint get request, it throws CORs error stating Allow Content Header Origin is not present.
I have the proper app domain, client id and redirect uri.
So what needs to be done in this situation for logout to work.
Cognito login works perfectly

[ManishJindalmanisism]

How can i use this token further in aws lambda to get the email id or username to do some dynamic processing? Are there any cognito sdk or library available to scrap that Information in aws lambda ?

[gunyung]

7:53 When you change the password the second time, it says 'localhost has refused to connect'.

How can I solve this?

8:44 I tried it on Postman, but I couldn't get the token's value and it came out the same way

[AthelstanEngland]

I'm a little lost... perhaps I've jumped in too deep before reading up more, but in essence how or what would you give a third party that you wanted to allow to access your API?

[Ronaldograxa]

why implicit grant rather than Authorization code grant? Aws doesn't recommend using Implicit Grant

[anandbabu]

AWS UI changed now. Cognito UI looks entirely new and unable to get published the user login page.😥

[honeykumarsingh]

how can i use access token here instead of ID token to authenticate our API?