使用Amazon Cognito Identity JS SDK，能否配置认证响应存令牌到HttpOnly Cookie？

Great question—let's break this down clearly:

Short Answer #

You can't directly use the SDK's built-in CookieStorage to store tokens in HttpOnly cookies. But there are solid workarounds if you need the security benefits of HttpOnly cookies.

Why the Built-in CookieStorage Doesn't Support HttpOnly #

The CookieStorage class provided by amazon-cognito-identity-js only lets you configure domain, path, expires, and secure—no option for HttpOnly. This isn't an oversight: HttpOnly cookies are intentionally inaccessible to client-side JavaScript, and the SDK needs to read tokens for core flows like session refresh and user context checks. If tokens were stored in HttpOnly cookies, the SDK wouldn't be able to access them at all.

How to Use HttpOnly Cookies with Cognito #

If your goal is to protect tokens from XSS attacks (the main reason for using HttpOnly cookies), here are two reliable approaches:

1. Proxy Authentication Through Your Backend

This is the most secure method:

• Instead of calling Cognito APIs directly from your frontend, send all auth requests (sign-in, sign-up, token refresh) to your backend server.
• Your backend communicates with Cognito, receives the tokens (ID, access, refresh), and then sets them as HttpOnly, Secure, SameSite cookies in the response to the frontend.
• For future requests, the browser automatically sends these cookies to your backend, which validates them before allowing access to your APIs.

2. Capture Tokens via SDK and Send to Backend

If you want to keep using the SDK's client-side auth logic:

• After a successful auth (e.g., in the authenticateUser callback), grab the tokens from the SDK's response.
• Send these tokens to your backend via an API call.
• Your backend then sets the tokens as HttpOnly cookies. Note that this does expose tokens briefly to client-side JS, so it's slightly less secure than the full backend proxy method.

Key Considerations #

• If you use HttpOnly cookies, you can't use SDK methods like getCurrentUser() anymore—those rely on reading tokens from client-side storage. You'll need to build backend endpoints to check session validity instead.
• Always combine HttpOnly with Secure (for HTTPS only) and SameSite=Strict or Lax to guard against CSRF attacks.

内容的提问来源于stack exchange，提问作者Mitch Lee