awslabs / cognito-at-edge

Serverless authentication solution to protect your website or Amplify application
Apache License 2.0
168 stars 54 forks source link

Use aws-jwt-verify to verify JSON Web Tokens #15

Closed ottokruse closed 2 years ago

ottokruse commented 2 years ago

Issue # (if available): N/A

Description of changes: AWS released a JWT verification library (disclaimer: I'm one of the main authors of that). This PR removes the dependency on jsonwebtoken and jwk-to-pem and instead uses the AWS JWT verification library: https://github.com/awslabs/aws-jwt-verify

Since that library has more built-in features (such as downloading and caching JWKS) I was able to remove quite a few lines from the lib here, because it has less to do now (which is good right). Test coverage has stayed the same (I notice there's a few lines of coding missing coverage, as they already did before)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.