class OmniAuth::Strategies::Cognito

OmniAuth strategy based on omniauth-oauth2 to authenticate with AWS Cognito. See github.com/omniauth/omniauth-oauth2.

Private Instance Methods

build_access_token() click to toggle source

See github.com/omniauth/omniauth-oauth2/issues/98 for redirect_uri reasoning

# File lib/omniauth/strategies/cognito.rb, line 48
def build_access_token
  client.auth_code.get_token(
    request.params['code'],
    { redirect_uri: callback_url }.merge(token_params.to_hash(symbolize_keys: true)),
    deep_symbolize(options.auth_token_params)
  )
end
callback_url() click to toggle source

See github.com/omniauth/omniauth-oauth2/issues/93 - must remove query params

# File lib/omniauth/strategies/cognito.rb, line 57
def callback_url
  full_host + script_name + callback_path
end
id_token() click to toggle source
# File lib/omniauth/strategies/cognito.rb, line 61
def id_token
  access_token && access_token['id_token']
end
parsed_id_token() click to toggle source
# File lib/omniauth/strategies/cognito.rb, line 65
def parsed_id_token
  return nil unless id_token

  @parsed_id_token ||= JWT.decode(
    id_token,
    nil,
    false,
    verify_iss: options[:aws_region] && options[:user_pool_id],
    iss: "https://cognito-idp.#{options[:aws_region]}.amazonaws.com/#{options[:user_pool_id]}",
    verify_aud: true,
    aud: options[:client_id],
    verify_sub: true,
    verify_expiration: true,
    verify_not_before: true,
    verify_iat: true,
    verify_jti: false,
    leeway: options[:jwt_leeway]
  ).first
end