fix(bb-auth-cognito): enable PreventUserExistenceErrors (close username enumeration oracle) - #293
Open
osama-rizk wants to merge 2 commits into
Open
fix(bb-auth-cognito): enable PreventUserExistenceErrors (close username enumeration oracle)#293osama-rizk wants to merge 2 commits into
osama-rizk wants to merge 2 commits into
Conversation
…ool client Cognito's default user pool client returns a distinct UserNotFoundException for unknown usernames vs. a wrong-password error for known ones, which is an account- enumeration oracle on sign-in and forgot-password. Setting preventUserExistenceErrors: true makes Cognito return a uniform error regardless of whether the username exists. The mock's public sign-in path already returns a uniform NotAuthorized error, so local↔AWS parity holds; the only user-existence-revealing throw is in the privileged admin surface, which is inside the trust boundary by design. Adds a CDK assertion that the synthesized UserPoolClient has PreventUserExistenceErrors: ENABLED (verified red on the prior code).
🦋 Changeset detectedLatest commit: f7b5ec4 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
soberm
approved these changes
Aug 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Enable
preventUserExistenceErrors: trueon the CognitoUserPoolClientinpackages/bb-auth-cognito/src/index.cdk.ts.this.userPoolClient = new cognito.UserPoolClient(this, 'client', { userPool: this.userPool, generateSecret: false, + // Return a uniform error for "user doesn't exist" and "wrong password" + // so sign-in / forgot-password responses can't enumerate registered + // usernames. Amazon's recommended posture is ENABLED. + preventUserExistenceErrors: true, disableOAuth: true, ...Why
Board bug-bash card (P1 / Security): bb-auth-cognito: user enumeration via PreventUserExistenceErrors unset — https://github.com/orgs/aws-amplify/projects/141/views/15?pane=issue&itemId=195532810
Cognito's default client returns a distinct
UserNotFoundExceptionfor unknown usernames vs. a wrong-password error for known ones — a classic account-enumeration oracle on sign-in and forgot-password (reported 3× across bench rounds R6/R8).PreventUserExistenceErrors: ENABLEDis Amazon's recommended setting.Mock parity
No mock change needed. The mock's public sign-in path already returns a uniform
NotAuthorized("Incorrect username or password") for both missing-user and wrong-password (index.ts), matchingENABLEDbehavior. The only user-existence-revealing throw (UserNotFound) is in the privileged admin surface (buildAdminSurface), which is inside the trust boundary by design — so local↔AWS behavior stays aligned.Testing
AWS::Cognito::UserPoolClienthasPreventUserExistenceErrors: ENABLED. Verified red on the prior code (Missing key 'PreventUserExistenceErrors'), green with the fix.npm run build(full monorepo) — passesnpm testinpackages/bb-auth-cognito— 231 tests, 0 failuresbiome lint --changed --since=origin/main— cleanChangeset
Included (
@aws-blocks/bb-auth-cognitopatch).