AWS iOS Cognito-如何在Userpool中检查用户？

Question

I am just starting to work with, and learn AWS. I am using the services in the AWS Mobile Hub and so far have set up the Sign In & Sign Up methods.

Everything works fine, and now I am working on the Forgot Password and Update Password .

Problem:

The problem is, is that the way AWS has set up the Forgot Password is that:

You first enter a username and then after the user enters a username AWS sends a verification code via SMS to the phone number associated with that username.

That's an issue because it means that anyone can enter any username and a text message will be sent, resulting in my SMS payments increasing and to be honest it just looks sloppy.

What I want to have done is that:

1. After a user enters a username, they then have to enter the phone number associated with the account
2. Then if it matches, it sends the SMS.

Question

• How do I check if a user exists in a userpool?
• And then if it does, how do I get the user attribute associated with the phone number to check if it matches the phone number that the user enters?
• Is this even possible? Can I even get the credentials of a user who isn't the one logged in?

Thanks in advance!

Answer 1

Cognito User Pools does not currently allow you to get attributes for a user (such as phone number) without that user having signed in and gotten an access token.

The admin apis can do the lookup you're looking for, but they shouldn't be called from the client as that would mean you have to embed credentials. If this is a must have for you, you could potentially secure those credentials by wrapping it in API Gateway or something along those lines and then call that from your client.

Answer 2

Here is how you should do it: 1) Create a web API using the APIGateway. Ideally you want to restrict access with an API Key, which you should bundle with your application. 2) Connect a POST method to a Lambda function, which will (a) perform the necessary checks (whether the phone number specified is indeed the correct one, etc), calling the admin_* functions. (b) issue the client version of the password reset, which will trigger the sending of the SMS code.