jetbridge / flask_cognito

Flask authentication with JWT against AWS Cognito
MIT License
94 stars 30 forks source link

`cognito_auth_required` should reject ID tokens (and only accept access tokens) #23

Closed joshfriend closed 3 years ago

joshfriend commented 3 years ago

ID tokens are given by the identity provider for the app to know information about the user who logged in (e.g. email, name).

Access tokens are issued by the identity provider to grant the app access to other APIs, which is the use case for anyone using this library.

More detailed explanation here: https://auth0.com/docs/tokens

Both ID and access tokens are currently accepted for cognito_auth_required.