将AWS Cognito JWT存储在前端JavaScript中是否不安全？风险咨询

Great question—let’s break down exactly what risks this exposed JWT poses and what steps you need to take right away.

Key Risks of Holding This Valid JWT #

• Unauthorized AWS Resource Access: Since this is a Cognito-signed JWT linked to an Identity Pool, anyone with this token can call AWS STS APIs like GetCredentialsForIdentity or AssumeRoleWithWebIdentity to retrieve temporary AWS credentials. The permissions tied to these credentials depend on the IAM role configured for the Cognito Identity Pool—this could mean access to sensitive data in S3, DynamoDB, or even write/modify permissions for connected services.
• User Identity Leakage: JWT payloads are base64-encoded (not encrypted), so anyone can easily decode it to get the username, useremail, and other user-specific details. This info can be used for phishing attacks, identity impersonation, or targeted harassment.
• Impersonation on the Website: If the site uses this Cognito JWT for session authentication, an attacker could use it to log in as the associated user, accessing their dashboard, personal data, or any restricted features tied to that account.
• Persistent Access (If Unrevoked): Unless the token is explicitly revoked or has expired (check the exp claim in the decoded payload), an attacker could continue to use it to generate AWS credentials or impersonate the user until it’s invalidated.

Should You Contact the Website to Revoke the Token? #

Absolutely—this is a critical security vulnerability that needs immediate attention. Here’s why:

• Hardcoding a valid user JWT in public frontend JavaScript is a major mistake. Tokens like this should never be exposed to untrusted users; they’re meant to be handled securely between authenticated clients and backend services.
• Even if the token is currently expired, the fact that it was exposed reveals a flaw in the site’s security practices. They need to audit their codebase to ensure no other credentials or sensitive tokens are leaking, and fix how they handle Cognito authentication flows.
• When reaching out, be clear about where you found the token (the specific JS file), redact any sensitive personal info (like the full email or pool ID) but note the key claims (kid, iss pointing to Cognito, user identifiers), and outline the potential risks we covered above.

内容的提问来源于stack exchange，提问作者StackB00m