nestjs-cognito logoNestJS-Cognito
NestJS-Cognito on GitHub

JWT Verification

The @nestjs-cognito/core package provides two mutually exclusive JWT verification implementations that share the same injection token. The implementation you get depends on your module configuration.

JWT Claims Verification

Both implementations perform comprehensive JWT claims verification according to AWS Cognito standards:

  • Expiration Check: Verifies the exp claim to ensure the token hasn't expired
  • Audience Validation:
    • For ID tokens: Validates the aud claim matches the app's client ID
    • For Access tokens: Validates the client_id claim matches the app's client ID
  • Issuer Verification: Validates the iss claim matches your Cognito User Pool's issuer URL format: https://cognito-idp.[REGION].amazonaws.com/[USER_POOL_ID]
  • Token Use Verification: Validates the token_use claim:
    • Must be access for access tokens
    • Must be id for ID tokens
    • Can be set to null to accept both token types

Cognito JWT Verification

When you configure jwtVerifier in your module, this implementation is used to verify JWTs issued by AWS Cognito:

import {
  CognitoJwtVerifier,
  InjectCognitoJwtVerifier
} from "@nestjs-cognito/core";

export class MyService {
  constructor(
    @InjectCognitoJwtVerifier()
    private readonly jwtVerifier: CognitoJwtVerifier
  ) {}

  async verifyToken(token: string) {
    return this.jwtVerifier.verify(token);
  }
}

RSA JWT Verification

When you configure jwtRsaVerifier in your module, this implementation is used to verify JWTs using RSA public keys:

import {
  JwtRsaVerifier,
  InjectCognitoJwtVerifier
} from "@nestjs-cognito/core";

export class MyService {
  constructor(
    @InjectCognitoJwtVerifier()
    private readonly jwtVerifier: JwtRsaVerifier
  ) {}

  async verifyToken(token: string) {
    return this.jwtVerifier.verify(token);
  }
}