将用户池“应用程序客户端 ID”设置为 HTTP API AWS YAML 的受众 - 令牌没有有效的受众

Question

您如何通过将正确的受众添加到 aws 授权方来解决 token does not have a valid audience？

一旦我使用带有有效 JWT 的 Authorization 标头，yaml 配置中的以下 sn-p 将返回 token does not have a valid audience

Auth:
  DefaultAuthorizer: JwtAuthentication
  Authorizers:
    JwtAuthentication:
      IdentitySource: $request.header.Authorization
      JwtConfiguration:
        audience:
          - my-audience
        issuer: !Sub https://cognito-idp.${AWS::Region}.amazonaws.com/${OperationsUserPool}

Answer 1

一旦我解码了我的 lambda 生成的 JWT

const login = await cognitoidentityserviceprovider
        .adminInitiateAuth(params)
        .promise();

我注意到audience 是App Client Id，但不知道如何获得audience 所以原来它是Ref 的AWS::Cognito::UserPoolClient

您可以在此处找到更多信息 https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolclient.html#cfn-cognito-userpoolclient-allowedoauthflowsuserpoolclient

Auth:
  DefaultAuthorizer: JwtAuthentication
  Authorizers:
    JwtAuthentication:
      IdentitySource: $request.header.Authorization
      JwtConfiguration:
        audience:
          - !Ref OperationsUserPoolClient
        issuer: !Sub https://cognito-idp.${AWS::Region}.amazonaws.com/${OperationsUserPool}

希望这对某人有所帮助！