Class CognitoJwtVerifier<SpecificVerifyProperties, IssuerConfig, MultiIssuer>

Class representing a verifier for JWTs signed by Amazon Cognito

Type Parameters

SpecificVerifyProperties extends Partial<CognitoVerifyProperties>
IssuerConfig extends JwtRsaVerifierProperties<SpecificVerifyProperties> & {
audience: null;
userPoolId: string;
}
MultiIssuer extends boolean

Hierarchy (view full)

JwtRsaVerifierBase<SpecificVerifyProperties, IssuerConfig, MultiIssuer>
- CognitoJwtVerifier

Index

Accessors

expectedIssuers

Methods

cacheJwks getIssuerConfig getVerifyParameters hydrate verify verifyDecomposedJwt verifyDecomposedJwtSync verifySync create parseUserPoolId

Accessors

`Protected` expectedIssuers

get expectedIssuers(): string[]
Returns string[]
Inherited from JwtRsaVerifierBase.expectedIssuers

Methods

cacheJwks

cacheJwks(...__namedParameters): void
This method loads a JWKS that you provide, into the JWKS cache, so that it is available for JWT verification. Use this method to speed up the first JWT verification (when the JWKS would otherwise have to be downloaded from the JWKS uri), or to provide the JWKS in case the JwtVerifier does not have internet access to download the JWKS
Parameters
- Rest ...__namedParameters: MultiIssuer extends false
  ? [jwks: Jwks, userPoolId?: string]
  : [jwks: Jwks, userPoolId: string]
Returns void
void

Overrides JwtRsaVerifierBase.cacheJwks

`Protected` getIssuerConfig

getIssuerConfig(issuer?): IssuerConfig & {
jwksUri: string;
}
Parameters
- Optional issuer: string
Returns IssuerConfig & {
jwksUri: string;
}
Inherited from JwtRsaVerifierBase.getIssuerConfig

`Protected` getVerifyParameters

getVerifyParameters(jwt, verifyProperties?): {
    decomposedJwt: DecomposedJwt;
    jwksUri: string;
    verifyProperties: SpecificVerifyProperties;
}
Get the verification parameters to use, by merging the issuer configuration, with the overriding properties that are now provided
Parameters
- jwt: string
- Optional verifyProperties: Partial<SpecificVerifyProperties>
Returns {
    decomposedJwt: DecomposedJwt;
    jwksUri: string;
    verifyProperties: SpecificVerifyProperties;
}
The merged verification parameters
- decomposedJwt: DecomposedJwt
- jwksUri: string
- verifyProperties: SpecificVerifyProperties
Inherited from JwtRsaVerifierBase.getVerifyParameters

hydrate

hydrate(): Promise<void>
Hydrate the JWKS cache for (all of) the configured issuer(s). This will fetch and cache the latest and greatest JWKS for concerned issuer(s).

Returns Promise<void>
void

Inherited from JwtRsaVerifierBase.hydrate

verify

verify<T>(...__namedParameters): Promise<CognitoIdOrAccessTokenPayload<IssuerConfig, T>>
Verify (asynchronously) a JWT that is signed by Amazon Cognito. This call is asynchronous, and the JWKS will be fetched from the JWKS uri, in case it is not yet available in the cache.
Type Parameters
- T extends Partial<CognitoVerifyProperties>
Parameters
- Rest ...__namedParameters: CognitoVerifyParameters<SpecificVerifyProperties>
Returns Promise<CognitoIdOrAccessTokenPayload<IssuerConfig, T>>
Promise that resolves to the payload of the JWT––if the JWT is valid, otherwise the promise rejects

Overrides JwtRsaVerifierBase.verify

`Protected` verifyDecomposedJwt

verifyDecomposedJwt(decomposedJwt, jwksUri, verifyProperties): Promise<JwtPayload>
Verify (asynchronously) an already decomposed JWT, that is signed using RS256 / RS384 / RS512.
Parameters
- decomposedJwt: DecomposedJwt
  The decomposed Jwt
- jwksUri: string
- verifyProperties: SpecificVerifyProperties
  The properties to use for verification
Returns Promise<JwtPayload>
The payload of the JWT––if the JWT is valid, otherwise an error is thrown

Inherited from JwtRsaVerifierBase.verifyDecomposedJwt

`Protected` verifyDecomposedJwtSync

verifyDecomposedJwtSync(decomposedJwt, jwksUri, verifyProperties): JwtPayload
Verify (synchronously) an already decomposed JWT, that is signed using RS256 / RS384 / RS512.
Parameters
- decomposedJwt: DecomposedJwt
  The decomposed Jwt
- jwksUri: string
- verifyProperties: SpecificVerifyProperties
  The properties to use for verification
Returns JwtPayload
The payload of the JWT––if the JWT is valid, otherwise an error is thrown

Inherited from JwtRsaVerifierBase.verifyDecomposedJwtSync

verifySync

verifySync<T>(...__namedParameters): CognitoIdOrAccessTokenPayload<IssuerConfig, T>
Verify (synchronously) a JWT that is signed by Amazon Cognito.
Type Parameters
- T extends Partial<CognitoVerifyProperties>
Parameters
- Rest ...__namedParameters: CognitoVerifyParameters<SpecificVerifyProperties>
Returns CognitoIdOrAccessTokenPayload<IssuerConfig, T>
The payload of the JWT––if the JWT is valid, otherwise an error is thrown

Overrides JwtRsaVerifierBase.verifySync

`Static` create

create<T>(verifyProperties, additionalProperties?): CognitoJwtVerifierSingleUserPool<T>
Create a Cognito JWT verifier for a single User Pool
Type Parameters
- T extends CognitoJwtVerifierProperties
Parameters
- verifyProperties: T & Partial<CognitoJwtVerifierProperties>
  The verification properties for your User Pool
- Optional additionalProperties: {
  jwksCache: JwksCache;
  }
  Additional properties
  - jwksCache: JwksCache
    Overriding JWKS cache that you want to use
Returns CognitoJwtVerifierSingleUserPool<T>
An Cognito JWT Verifier instance, that you can use to verify Cognito signed JWTs with
create<T>(props, additionalProperties?): CognitoJwtVerifierMultiUserPool<T>
Create a Cognito JWT verifier for multiple User Pools
Type Parameters
- T extends CognitoJwtVerifierMultiProperties
Parameters
- props: (T & Partial<CognitoJwtVerifierMultiProperties>)[]
- Optional additionalProperties: {
  jwksCache: JwksCache;
  }
  Additional properties
  - jwksCache: JwksCache
    Overriding JWKS cache that you want to use
Returns CognitoJwtVerifierMultiUserPool<T>
An Cognito JWT Verifier instance, that you can use to verify Cognito signed JWTs with

`Static` parseUserPoolId

parseUserPoolId(userPoolId): {
issuer: string;
jwksUri: string;
}
Parse a User Pool ID, to extract the issuer and JWKS URI
Parameters
- userPoolId: string
  The User Pool ID
Returns {
issuer: string;
jwksUri: string;
}
The issuer and JWKS URI for the User Pool
- issuer: string
- jwksUri: string

Class CognitoJwtVerifier<SpecificVerifyProperties, IssuerConfig, MultiIssuer>

Type Parameters

SpecificVerifyProperties extends Partial<CognitoVerifyProperties>

IssuerConfig extends JwtRsaVerifierProperties<SpecificVerifyProperties> & { audience: null; userPoolId: string; }

MultiIssuer extends boolean

Hierarchy (view full)

Index

Accessors

Methods

Accessors

Protected expectedIssuers

Returns string[]

Methods

cacheJwks

Parameters

Rest ...__namedParameters: MultiIssuer extends false ? [jwks: Jwks, userPoolId?: string] : [jwks: Jwks, userPoolId: string]

Returns void

Protected getIssuerConfig

Parameters

Optional issuer: string

Returns IssuerConfig & { jwksUri: string; }

Protected getVerifyParameters

Parameters

jwt: string

Optional verifyProperties: Partial<SpecificVerifyProperties>

Returns { decomposedJwt: DecomposedJwt; jwksUri: string; verifyProperties: SpecificVerifyProperties; }

decomposedJwt: DecomposedJwt

jwksUri: string

verifyProperties: SpecificVerifyProperties

hydrate

Returns Promise<void>

verify

Type Parameters

T extends Partial<CognitoVerifyProperties>

Parameters

Rest ...__namedParameters: CognitoVerifyParameters<SpecificVerifyProperties>

Returns Promise<CognitoIdOrAccessTokenPayload<IssuerConfig, T>>

Protected verifyDecomposedJwt

Parameters

decomposedJwt: DecomposedJwt

jwksUri: string

verifyProperties: SpecificVerifyProperties

Returns Promise<JwtPayload>

Protected verifyDecomposedJwtSync

Parameters

decomposedJwt: DecomposedJwt

jwksUri: string

verifyProperties: SpecificVerifyProperties

Returns JwtPayload

verifySync

Type Parameters

T extends Partial<CognitoVerifyProperties>

Parameters

Rest ...__namedParameters: CognitoVerifyParameters<SpecificVerifyProperties>

Returns CognitoIdOrAccessTokenPayload<IssuerConfig, T>

Static create

Type Parameters

T extends CognitoJwtVerifierProperties

Parameters

verifyProperties: T & Partial<CognitoJwtVerifierProperties>

Optional additionalProperties: { jwksCache: JwksCache; }

jwksCache: JwksCache

Returns CognitoJwtVerifierSingleUserPool<T>

Type Parameters

T extends CognitoJwtVerifierMultiProperties

Parameters

props: (T & Partial<CognitoJwtVerifierMultiProperties>)[]

Optional additionalProperties: { jwksCache: JwksCache; }

jwksCache: JwksCache

Returns CognitoJwtVerifierMultiUserPool<T>

Static parseUserPoolId

Parameters

userPoolId: string

Returns { issuer: string; jwksUri: string; }

issuer: string

jwksUri: string

Settings

Member Visibility

Theme

On This Page

IssuerConfig extends JwtRsaVerifierProperties<SpecificVerifyProperties> & {
audience: null;
userPoolId: string;
}

`Protected` expectedIssuers

`Rest` ...__namedParameters: MultiIssuer extends false
? [jwks: Jwks, userPoolId?: string]
: [jwks: Jwks, userPoolId: string]

`Protected` getIssuerConfig

`Optional` issuer: string

Returns IssuerConfig & {
jwksUri: string;
}

`Protected` getVerifyParameters

`Optional` verifyProperties: Partial<SpecificVerifyProperties>

Returns {
decomposedJwt: DecomposedJwt;
jwksUri: string;
verifyProperties: SpecificVerifyProperties;
}

`Rest` ...__namedParameters: CognitoVerifyParameters<SpecificVerifyProperties>

`Protected` verifyDecomposedJwt

`Protected` verifyDecomposedJwtSync

`Rest` ...__namedParameters: CognitoVerifyParameters<SpecificVerifyProperties>

`Static` create

`Optional` additionalProperties: {
jwksCache: JwksCache;
}

`Optional` additionalProperties: {
jwksCache: JwksCache;
}

`Static` parseUserPoolId

Returns {
issuer: string;
jwksUri: string;
}