Has anyone tried using AWS based API from mobile app?
I set up AWS simple Back end (lambdas) for my upcoming mobile app.
I want to authenticate each API request.
I can always include some secret inside my app code that my REST knows, but we all know this is not very safer option.
What are my options? Please also indicate the cost sides of every options.
I checked out AWS amplify sdk some time ago but I do not have very good experience of it. Besides, I am against making my native app code full of 3rd party SDKs and all. I need a generic way of secure access to my API.
(Please note that user authentication is not something I am looking to handle through that. My REST implementation can handle it. )
I saw AWS Cognito but as I see it, it depends on Amplify iOS SDK. If Amazon Amplify is my only option for such a token based implementation, I would like to see any examples of it as I could not find it on their github.
Thank you for your time!
The standard solution requires an authorization service, which is nowadays an OAuth2 Authorization service like AWS Cognito ( or others like Auth0, Okta). They issue short-lived JWT signed tokens. The token includes the user id in the Subject field and other user claims like roles subscription plans etc. You put these tokens into the Authorization header of the request to your API endpoint served by Lambda. In the lambda function, you decode and validate the token and get the user claims and decide based on them if the user allowed to do the given lambda operation. Amplify and other providers provide SDKs that helps you simplify this process.
Thanks, yes I know about the process in general. I will try Cognito if its the only option and cost effective .The question is, AWS Amplify is the only way to get token from Cognito? If there is another way I would like to know....
It implements OpenID Connect 1.0 and OAuth 2.0 standard endpoints so you can use any client which can implements these.
I am not sure if I understood your question correctly but let me try.
It looks like you want to add some sort of token based authentication to your existing lambda functions. Amplify is definitely the easiest and recommend option in my opinion. There are many examples of API authentication in the official documentation https://aws-amplify.github.io/docs/ios/authentication
If you don't want to use amplify, then I would suggest to generate a simple UUID on every successful signup/login, store that UUID in DB with a TTL and then use that UUID for further calls to the API.
Thank you for the reply. I am not sure I am with that idea though. If an app is public, anyone can extract request params. Malicious users can do a fake sign up to obtain a UDID. What am I missing here?
I wrote a full blow AWS based app last year, using Lambda, Dynamo, API gateway, Cognito, IoT and S3.
Just like you, I did not wanna to rely on secrets for my REST call, so I implemented a "hash salt" for a key, based on user's password.
Let me try to explain:
I used username/password as a way to hash some "magic string", that was then validated by another Lambda app.
It has been working great, and as the user password on our case is on the local DB (that we store just a hash of it), we have been having zero support calls for it.
Hope this gives you some ideas to avoid the weird "secret key"....
Seems exciting...thanks for the out of box idea.
How do you generate this magic string every time so that your server is able to decrypt it correctly, I am curious.
If you have a blog post or git repo you could point to, I would be grateful. I am still in the early days of studying Serverless/AWS etc. and practical examples really help. Thanks in advance.
A secret key is not safe to put on your clients, please don't do that.
Consider Auth0 (https://auth0.com/). They have several mobile SDKs (Android, iOS, or React Native) that should be able to get you going quickly.
Once your users have authenticated with Auth0, they will have a JWT token that your backend can then verify against Auth0. This type of third party authentication mechanism is called OAuth, it is very straight forward to setup.
Let me know if you have questions!
thanks! I have read a lot about OAuth but never found AWS implementation example of OAuth, not to mention anything with respect to Cognito. If you have any links...
I would start here: https://auth0.com/docs/getting-started/the-basics
It goes over what the basic pieces are for a third part authentication system and walks you through each step.