search

marmelab / ra-auth-cognito

An auth provider for react-admin which handles authentication with AWS Cognito.
MIT License
9 stars 6 forks source link

Possibility to set Authorization code flow as an alternative for implicit grant for hosted UI support #14

Open Ressvieth opened 7 months ago

Ressvieth commented 7 months ago

Current solution works only with implicit grant type, but this approach is not recommended due to security issues: https://oauth.net/2/grant-types/implicit/

There can be an easy fix set for hosted ui support option, to use Authorization code flow (https://oauth.net/2/grant-types/authorization-code/) - adding optional request for token endpoint inside handleCallback method.

https://docs.aws.amazon.com/cognito/latest/developerguide/token-endpoint.html