如何修改 AWS Cognito JWT 令牌，我们正在使用 NodeJS 技术问题

Question

I am using AWS Cognito for user management. I am getting too much information in JWT Token (in payloads). I do not want to pass it on to receiving API Client. So my question is how do I reduce the data or get the data which is only necessary for the user. Sending that much data is the security issue.

I don't find any documentation or console controls to modify the same.

For example I only want:

"exp": 0000000000,
"at":  0000000000,
"username":"exampleUsername"

Answer 1

It sounds like you have a client that might be third party, or you trust less. You can setup a separate Cognito UserPool App Client for this application. Then write a Pre Token Generation Lambda to suppress token fields you do not want to expose to this client, and assign it to the correct UserPool App Client.

https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-token-generation.html

You probably already know this, but you cannot edit a token after it is issued without invalidating the token.