Amplify-js: Inviting and confirming users securely?

[stephenhuh]

* Which Category is your question related to? *
Amplify.signIn in the case of confirming a user after invitation on dashboard or adminCreateUser.

* What AWS Services are you utilizing? *
Just Cognito.

* Provide additional details e.g. code snippets *

I'm currently using adminCreateUser when a user invites another user to sign up onto the platform. The invited user has his/her password set to testing at the moment. Upon calling adminCreateUser we send an invitation email to the new user with a button to join the platform and claim the acct. However, the docs suggest using Auth.signIn and Auth.completeNewPassword() on these users. I may be misunderstanding something, but this seems insecure as a malicious party could just send his/her own Auth.SignIn and Auth.completeNewPassword to claim another person's account. Any clarification would be super helpful. (More info below)

The docs for Amplify suggest this strategy when using adminCreateUser.

The user would be asked to provide his new password and required attributes the first time he signs in if he is created in the AWS Cognito console. In that case, you need to call this method to finish this process:

import { Auth } from 'aws-amplify';

Auth.signIn(username, password)
.then(user => {
    if (user.challengeName === 'NEW_PASSWORD_REQUIRED') {
        const { requiredAttributes } = user.challengeParam; // the array of required attributes, e.g ['email', 'phone_number']
        Auth.completeNewPassword(
            user,               // the Cognito User Object
            newPassword,       // the new password
            // OPTIONAL, the required attributes
            {
              email: '[email protected]',
              phone_number: '1234567890'
            }
        ).then(user => {
            // at this time the user is logged in if no MFA required
            console.log(user);
        }).catch(e => {
          console.log(e);
        });
    } else {
        // other situations
    }
}).catch(e => {
    console.log(e);
});

[undefobj]

malicious party could just send his/her own Auth.SignIn and Auth.completeNewPassword to claim another person's account

How would the third party have access to the email address of the user which the admin wishes to send a sign-up invitation? You still need to own the verification channel (email, phone, etc.) where the invite is being sent.

[wmlutz]

I am working through a similar (but slightly different maybe) issue.

I have an administrator view and want to call something like Auth.adminCreateUser but don't have that functionality. My app is invite-only. It feels weird loading the Cognito API just for the adminCreateUser function when I'm using Amplify for everything else.

[stephenhuh]

@wmlutz yep! that's where this issue actually spawned from -- it definitely is not intuitive, but that seems to be the way to go if you want adminCreateUser like functionality.

[jordanranz]

Was your original question answered @stephenhuh?

If not can you please elaborate. I am thinking this may be a feature request to build adminCreateUser into Amplify Auth?

[PaulGLujan]

adminCreateUser should be incorporated into Amplify. I am running into the same issue where I have to use the Cognito SDK for adminCreateUser

[stephenhuh]

@jordanranz -- i'd agree with @PaulGLujan and @wmlutz as I had run into a similar issue which was where this case stemmed from but it should probably be a new issue/feature-request.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale[bot]]

This issue has been automatically closed because of inactivity. Please open a new issue if are still encountering problems.

[gkpty]

Hey, know the issue has been closed for inactivity but i just ran into this.

my work around (not using the cognito SDK)

1. i implemented authorization with groups.
2. i switched confirmation message in cognito to a link
3. implemented a custom field in users called parentUser (or organization in my case)
4. i check for user group and give admin users access to a component called inviteUsers
5. i built a form inside inviteUsers with my signUp fields.

bellow is the submit handler for the form

handleSubmit = async (event) => {
        event.preventDefault();
        try {
            await Auth.signUp({
                'username':this.state.username,
                'password':this.state.password,
                'attributes': {
                    'email':this.state.email,
                    'custom:organization':this.state.org.id,
                }
            }).then(result => {
                console.log(`Succesfully invited ${result.user.username}`);
                return result
        } catch (err) {
            console.log('error signing up: ', err);
            return err
        }
    }

Hope this helps!

[asungomez]

Hey

I was concerned about the security issues pointed out in https://github.com/aws-amplify/amplify-js/issues/2582#issue-401015157, so I've been attempting to edit another user's password using an Auth.completeNewPassword equivalent request. The process has been:

1. Create a new user using an invitation message and set its new password as recommended.
2. Check the request sent to Cognito by Amplify. It doesn't have any authentication headers, all the authentication-related info is sent in the Session field, which according to the documentation seems to be optional.
3. I've tried an attack by sending a request to Cognito without the Session field attempting to edit an arbitrary user's password. I got a Missing parameter session error.
4. I've tried setting an arbitrary session value, and it didn't go through either. The error response was Invalid session for the user.

So a potential attacker would need to know the user sub and the session value to actually edit this field. Seems secure enough.