Question

A developer is building a confidential server-side web application (running on a backend host) that authenticates users through an Amazon Cognito user pool using the OAuth 2.0 authorization code grant. During setup, the developer must decide how to configure the Cognito app client so that token exchange requests from the backend are properly authenticated. Which configuration is the MOST appropriate for this backend application?

Accepted Answer

Create the app client with a generated client secret and include the secret when the backend exchanges the authorization code for tokens.

Answer

Create the app client without a client secret because Cognito app clients never support secrets.

Answer

Embed the client secret in the browser-side JavaScript so the user's browser can call the token endpoint directly.

Answer

Disable the authorization code grant and use the implicit grant so no secret is required.