Skip to content

chore(HNT-2502): stop accepting CognitoAdmin-Prod tokens #380

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mmiermans merged 2 commits into from
Apr 23, 2026
Merged

chore(HNT-2502): stop accepting CognitoAdmin-Prod tokens #380

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ed87c1a
chore(HNT-2502): stop accepting CognitoAdmin-Prod tokens
mmiermans Apr 22, 2026
25be56f
Merge branch 'main' into HNT-2502-drop-cognito-admin-prod
mmiermans Apr 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 0 additions & 13 deletions src/config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,19 +22,6 @@ const config = {
environment: process.env.NODE_ENV || 'development',
},
auth: {
//Cognito is deprecated in favor of Mozilla Auth Proxy, but we still need to support it

@mmiermans mmiermans Apr 22, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The "we still need to support it" statement was probably made because of a desire in 2022 to gradually migrate users to the new pool without disruption. The pool has no user activity since 2024.

//Mozilla Auth Proxy supports a larger number of user groups for a user.
cognito: {
jwtIssuer:
// COGNITO_JWT_ISSUER is not set in this repo (or anywhere?)
process.env.COGNITO_JWT_ISSUER ||
'cognito-idp.us-east-1.amazonaws.com/us-east-1_1alKls4qw',
// COGNITO_KIDS is not set in this repo (or anywhere?)
kids: process.env.COGNITO_KIDS?.split(',') || [
'kze4M0CiXoDO7Qkpig1oH0F6OInzZg6ugk0PyojOlzc=',
'4w35mrh4EBECpjJnyIjdQ60yjh3xeI1m0VF1H/z0T/c=',
],
},
mozillaAuthProxy: {
jwtIssuer:
// MOZILLA_AUTH_PROXY_JWT_ISSUER is not set in this repo (or anywhere?)
Expand Down
29 changes: 1 addition & 28 deletions src/jwtUtils.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,26 +55,6 @@ describe('jwtUtils', () => {
process.env.NODE_ENV = originalNodeEnv;
});

const cognitoJwks = {
keys: [
{
alg: 'RS256',
e: 'AQAB',
kid: 'kze4M0CiXoDO7Qkpig1oH0F6OInzZg6ugk0PyojOlzc=',
kty: 'RSA',
n: 'uXk44uWZ2tx',
use: 'sig',
},
{
alg: 'RS256',
e: 'AQAB',
kid: '4w35mrh4EBECpjJnyIjdQ60yjh3xeI1m0VF1H/z0T/c=',
kty: 'RSA',
n: '7LjXOvCWl6Y',
use: 'sig',
},
],
};
const mozillaAuthProxyJwks = {
keys: [
{
Expand Down Expand Up @@ -213,26 +193,20 @@ describe('jwtUtils', () => {
};

it.each(['production', 'development'])(
`should get keys from cognito and pocket in %s`,
`should get keys from mozilla auth proxy and pocket in %s`,
async (env) => {
// Override NODE_ENV and dynamically import getSigningKeysFromServer to re-compute the config in the given env.
process.env.NODE_ENV = env;
const { getSigningKeysFromServer } = await import('./jwtUtils');

const expectedKids = [
'kze4M0CiXoDO7Qkpig1oH0F6OInzZg6ugk0PyojOlzc=',
'4w35mrh4EBECpjJnyIjdQ60yjh3xeI1m0VF1H/z0T/c=',
'OR8erz5A8/hCkVdHczk879k2zUQXoAke9p8TQXsgKLQ=',
'QtBbT/twDz6JmT99PQkAOB+QBhG4eJvxk8pOr7YzfWU=',
...(env === 'development'
? ['CMGDEV', 'CORDEV', 'SMGRDV', 'MLMDEV', 'PTLDEV', 'HNTCPN']
: ['CURMIG', 'CORPSL', 'SEMGRL', 'MLMFLO', 'PROTRL', 'HNTCPP']),
];

const cognitoMock = nock('https://' + config.auth.cognito.jwtIssuer)
.persist()
.get('/.well-known/jwks.json')
.reply(200, cognitoJwks);
const mozillaAuthProxyMock = nock(
'https://' + config.auth.mozillaAuthProxy.jwtIssuer,
)
Expand All @@ -248,7 +222,6 @@ describe('jwtUtils', () => {

expect(Object.keys(keys)).toEqual(expectedKids);

cognitoMock.persist(false);
mozillaAuthProxyMock.persist(false);
},
);
Expand Down
12 changes: 0 additions & 12 deletions src/jwtUtils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,17 +129,6 @@ function getJwksClient(jwksUri: string) {
});
}

/**
* Get JWKs from cognito
*/
function getCognitoJwks() {
const jwksUri = `https://${config.auth.cognito.jwtIssuer}/.well-known/jwks.json`;
const client = getJwksClient(jwksUri);
return config.auth.cognito.kids.map((kid: string) =>
client.getSigningKeyAsync(kid),
);
}

/**
* Get JWKs from mozilla auth proxy
*/
Expand Down Expand Up @@ -170,7 +159,6 @@ export const getSigningKeysFromServer = async (): Promise<
Record<string, string>
> => {
const keys = await Promise.all([
...getCognitoJwks(),
...getMozillaAuthProxyJwks(),
...getPocketJwks(),

@mmiermans mmiermans Apr 22, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this could be removed too?

]);
Expand Down
Loading