Tự build authentication cho app mới mất hàng tuần. Cognito làm tất cả — nhưng ít người biết JWT Authorizer tích hợp API Gateway mới là killer feature thực sự. Mình thường dùng Cognito vì lý do đơn giản: không muốn build forgot password flow lần thứ ba.
flowchart LR
User["User"] -->|"login"| Cognito["Cognito User Pool"]
Cognito -->|"JWT (id + access + refresh)"| User
User -->|"Authorization: Bearer JWT"| APIG["API Gateway<br/>JWT Authorizer"]
APIG --> Lambda["Lambda"]
import { JwtRsaVerifier } from "aws-jwt-verify";
const verifier = JwtRsaVerifier.create({
issuer: `https://cognito-idp.ap-southeast-1.amazonaws.com/ap-southeast-1_xxx`,
audience: "abc123clientid",
tokenUse: "access",
});
const payload = await verifier.verify(token); // { sub, email, scope, ... }
| Trigger | When | Use |
|---|---|---|
| Pre Sign-up | Before user creation | Validate email domain, block spam |
| Post Confirmation | After email verify | Create user profile in DB, welcome email |
| Pre Authentication | Before login | Custom rate limiting, IP check |
| Pre Token Generation | Before JWT creation | Add custom claims to token |