I have a simple definition such as:
const userPoolClient = new UserPoolClient(this, 'MyUserPool', {
userPool,
oAuth: {
callbackUrls: ['http://localhost/callback'],
flows: {
authorizationCodeGrant: true,
},
scopes: [OAuthScope.OPENID, OAuthScope.PROFILE],
},
generateSecret: false,
authFlows: {
custom: false,
},
});Notice, that it sets the custom auth flow to to false. However, after deploying this the following is observed in the console:
I.e. both custom and SRP are enabled without me specifying this.
Cause
I believe the below function is at fault as it only checks if any values are true before setting the CloudFormation property ExplicitAuthFlows.
|
private configureAuthFlows(props: UserPoolClientProps): string[] | undefined { |
|
if (!props.authFlows) return undefined; |
|
|
|
const authFlows: string[] = []; |
|
if (props.authFlows.userPassword) { authFlows.push('ALLOW_USER_PASSWORD_AUTH'); } |
|
if (props.authFlows.adminUserPassword) { authFlows.push('ALLOW_ADMIN_USER_PASSWORD_AUTH'); } |
|
if (props.authFlows.custom) { authFlows.push('ALLOW_CUSTOM_AUTH'); } |
|
if (props.authFlows.userSrp) { authFlows.push('ALLOW_USER_SRP_AUTH'); } |
|
|
|
// refreshToken should always be allowed if authFlows are present |
|
if (authFlows.length > 0) { |
|
authFlows.push('ALLOW_REFRESH_TOKEN_AUTH'); |
|
} |
|
|
|
if (authFlows.length === 0) { |
|
return undefined; |
|
} |
|
return authFlows; |
|
} |
Possible Solution
Possibly the following:
|
// refreshToken should always be allowed if authFlows are present |
|
if (authFlows.length > 0) { |
|
authFlows.push('ALLOW_REFRESH_TOKEN_AUTH'); |
|
} |
Should be changed to unconditionally push ALLOW_REFRESH_TOKEN_AUTH (as the case props.authFlows is undefined is already handled). I.e., it should be changed to:
authFlows.push('ALLOW_REFRESH_TOKEN_AUTH'); This would mean when the user provides a authFlows property the default behaviour will always be replaced, not only if a true value is provided for one of the options.
I have a simple definition such as:
Notice, that it sets the
customauth flow to tofalse. However, after deploying this the following is observed in the console:I.e. both custom and SRP are enabled without me specifying this.
Cause
I believe the below function is at fault as it only checks if any values are true before setting the CloudFormation property
ExplicitAuthFlows.aws-cdk/packages/@aws-cdk/aws-cognito/lib/user-pool-client.ts
Lines 410 to 428 in 1d54a45
Possible Solution
Possibly the following:
aws-cdk/packages/@aws-cdk/aws-cognito/lib/user-pool-client.ts
Lines 419 to 422 in 1d54a45
Should be changed to unconditionally push
ALLOW_REFRESH_TOKEN_AUTH(as the caseprops.authFlowsis undefined is already handled). I.e., it should be changed to:This would mean when the user provides a
authFlowsproperty the default behaviour will always be replaced, not only if a true value is provided for one of the options.