jwtcognito

README

jwtcognito is an easy to use, small package designed to parse request headers and look for JWTs provided by AWS Cognito to either check if they are valid or get the claims in them.

Install

$ go get github.com/bruno-chavez/jwtcognito

Usage

Import the package, get the set of JWKs with GetJWKs and either call CheckHeader or GetClaims depending of your use case.

• The region, User Pool ID and App Client can all be found inside AWS Cognito.

• The most common type of tokens that Cognito uses for authentication are either accessToken, idToken or refreshToken, it provides more depending of your User Pool configuration. If you need to check for user data like emails, names or associated groups idToken is what you are looking for.

• The claims inside each JWT varies depending of what type of token you are using.

Examples

Basic

Checking for a valid JWT

jwks, err := jwtcognito.GetJWK("us-east-1", "us-east-1_apwePSzx")
if err != nil {
    log.Println(err)
}

err := jwtcognito.CheckHeader(r, jwks, "3b1fh12qzvmgjuio563qtm678u", "idToken")
if err != nil {
    log.Println(err)
}

Looking up a specific claim

GetClaims works mostly like CheckHeader the only difference is it that returns a map of type map[string]interface{}, with all the claims of the token in it, including custom attributes.

jwks, err := jwtcognito.GetJWK("us-east-1", "us-east-1_apwePSzx")
if err != nil {
    log.Println(err)
}

claims, err := jwtcognito.CheckHeader(r, jwks, "3b1fh12qzvmgjuio563qtm678u", "idToken")
if err != nil {
    log.Println(err)
}

log.Println(claims["cognito:groups"])

Looking up all the groups of a user

jwks, err := jwtcognito.GetJWK("us-east-1", "us-east-1_apwePSzx")
if err != nil {
    log.Println(err)
}

groups, err := jwtcognito.CheckHeader(r, jwks, "3b1fh12qzvmgjuio563qtm678u")
if err != nil {
    log.Println(err)
}

log.Println(groups)

Intermediate

Check for a specific user email

func CheckUser(w http.ResponseWriter, r *http.Request) {
    	
    jwks, err := jwtcognito.GetJWK("us-east-1", "us-east-1_apwePSzx")
    if err != nil {
        return 
    }
    
    claims, err := jwtcognito.GetClaims(, jwks, "3b1fh12qzvmgjuio563qtm678u", "idToken")
    if err != nil {
        return
    }

    if claims["email"] != "admin@admin.admin {
        return
    }
}

Contribute

Found an bug or an error? Post it in the issue tracker.

Want to add an awesome new feature? Fork this repository and add your feature, then send a pull request.

License

The MIT License (MIT) Copyright (c) 2019 Bruno Chavez

Documentation

Overview

Package jwtcognito contains the API of the package.

Index

• func CheckHeader(request *http.Request, jwks *jwk.Set, appClient string, tokenType string) error
• func GetClaims(request *http.Request, jwks *jwk.Set, appClient string, tokenType string) (map[string]interface{}, error)
• func GetGroups(request *http.Request, jwks *jwk.Set, appClient string) ([]string, error)
• func GetJWK(region, userPool string) (*jwk.Set, error)

Functions

func CheckHeader

func CheckHeader(request *http.Request, jwks *jwk.Set, appClient string, tokenType string) error

GetClaims parses a request header and looks for a valid JWT from AWS Cognito and returns a map with the claims of it.

func GetClaims

func GetClaims(request *http.Request, jwks *jwk.Set, appClient string, tokenType string) (map[string]interface{}, error)

GetClaims parses a request header and looks for a valid JWT from AWS Cognito and returns a map with the claims of it.

func GetGroups

func GetGroups(request *http.Request, jwks *jwk.Set, appClient string) ([]string, error)

GetClaims parses a request header and looks for a valid JWT from AWS Cognito and returns a slice with all the groups that user is in.

func GetJWK

func GetJWK(region, userPool string) (*jwk.Set, error)

GetJWK is used with in conjunction of the other functions to get claims of validate a token.