React 和 Axios 获取 AWS 客户端凭证

Question

I'm using latest version of react with axios and want to get an authentication token from aws / cognito. Therefore I have my client and client secret. When I send a curl request, it works as expected, but when I send the request via axios, I always get a status 405 response.

My code looks as follows:

...
        axios({
            url: 'https://xyz.amazoncognito.com/oauth2/token?grant_type=client_credentials',
            method: 'POST',
            headers: {
                'Content-Type': 'application/x-www-form-urlencoded',
                'client_id': '***************',
                'client_secret': '****************'
                'redirect_uri': 'http://localhost:4200'
            }
        })
       .then((response) => {
            console.log(response);
       }, (error) => {
            console.log(error);
       });

Instead of setting client_id, client_secret and redirect_uri to the headers, I added them in the url like

...grant_type=client_credentials&client_id=************&client_secret=*************&redirect_uri=http%3A%2F%2Flocalhost%3A4200

with the same result. Any ideas, what I'm doing wrong? As a side remark: I'm using axios for all my api requests and so I would like to stay at axios also in this case.

Thanks and kind regards,

Balu

Answer 1

You are not passing the required parameters correctly. Have a look at the example here: https://docs.aws.amazon.com/cognito/latest/developerguide/token-endpoint.html

The required headers will be:

Authorization If the client was issued a secret, the client must pass its client_id and client_secret in the authorization header through Basic HTTP authorization. The secret is Basic Base64Encode(client_id:client_secret).

Content-Type Must always be 'application/x-www-form-urlencoded'.

The other information will be passed as request parameters.

This being said, you should not store your client and client secret on the client side (React application). If this is exposed on the client, anyone can get your client ID and Client secret and obtain a Cognito Token.