Missing nonce when using AWS Cognito HostedUI

[PritamDutt]

Description

As per the current release of the sdk, it is mandatory for presence of nonce in idToken (JWT) for authentication to go through, which is not possible if one has implemented AWS Cognito Hosted UI as per the following links:

• the usage of AWS SDK and AdminIntiateAuth/InitiateAuth does not allow the providing of a nonce as the per the issuance of the JWTs.

• You can't modify the nonce claim

My suggestion would be to relax this requirement, by the means of may be some configurable flag till we have blessings of Cognito Team 🤓

Categories

• Analytics
• API (REST)
• API (GraphQL)
• Auth
• Authenticator
• DataStore
• Storage

Steps to Reproduce

1. Setup a Cognito user pool with custom hosted e.g. AWS Sample
2. Create a user the pool
3. Create a client id
4. Setup flutter app
5. Configure Flutter App to use the client id setup in Step 3. above AWS Sample
6. Choose to login using hosted ui

Result: you get missing nonce error

Screenshots

No response

Platforms

• iOS
• Android
• Web
• macOS
• Windows
• Linux

Flutter Version

3.3.10

Amplify Flutter Version

1.1.0

Deployment Method

Amplify CLI

Schema

No response

[dnys1]

Hi @PritamDutt, sorry you are facing this issue. This seems to be an issue in the identity broker implementation (awslabs/aws-amplify-identity-broker#127) since both the OpenID Connect specification and Cognito's own docs mandate the inclusion of a nonce value in the ID token when it's sent with the authorization request.

If we changed the implementation to accommodate the identity broker, we would potentially be lowering the security posture for Cognito users. I'm not sure how best to handle the situation, but I will bring it to the attention of my team to see what we can do.

[PritamDutt]

@dnys1 Really appreciate your commitment for ensuring implementation of OIDC specs, however considering the fact that there is no way (at least not in my knowledge) to pass on the incoming nonce value in AdminInitiateAuth / InitiateAuth ops being performed in custom /oauth2/authorize lambda function, I think there is need to make room for this limitation imposed by AWS's own SDK.

[dnys1]

Understood, and thank you for all the info. I will keep you posted.

[dnys1]

Hi @PritamDutt, we are looking into removing the nonce check since it seems to mainly protect against replay attacks with the implict OAuth grant, which we don't support. I will keep you posted on the progress and have opened a PR here if you want to work with that in the meantime.

[dnys1]

Hi @PritamDutt, sorry for the long delay on this. The fix has been merged and will be released in the near future.

[dnys1]

@PritamDutt this has been fixed in Amplify Auth v1.3.1. Thanks for your patience resolving this issue.