capless / warrant

Python library for using AWS Cognito. With support for SRP.
Apache License 2.0
468 stars 192 forks source link

register: secret hash issue #105

Open anyeone opened 6 years ago

anyeone commented 6 years ago

I have an app pool with a client secret and either I'm doing something wrong, or i've uncovered an issue with the register() method when requiring a client secret.

The instructions for instantiating the Cognito object for register do not include the username parameter (which makes sense, since you are trying to create one). So self.username is None.

However, the register method calls: self._add_secret_hash(params, 'SecretHash') which if you follow the tree is trying to hash self.username + client id + client secret. BEFORE it creates the user, so it throws a null reference exception.

I think that the readme needs to state that if you have a client secret, you need to include the username when you instantiate Cognito (or alternatively, modify the implementation to populate the self.username from the one passed in on the register() method BEFORE trying to add secret hash.

metoikos commented 4 years ago

We are already passing username argument to the register method. It could update the class attribute self.username then it would solve the problem.

I don't know if you are maintaining this library (and saw that 15 PR's are waiting) but if you accept I can create another one to fix this issue.