android - AWS Cognito 接受任何密码

Question

我是第一次使用 Android 应用程序实现 AWS。

我们想使用 Cognito 对我们的用户进行身份验证，并有选择地提供来自 DynamoDB 的数据。

我已成功设置我的用户池，并且可以看到新注册出现在用户列表中。尝试使用不存在的电子邮件登录失败。

但是，Cognito 始终使用有效的电子邮件地址登录，无论输入什么密码。

我的流程有什么问题？

public class CognitoController extends Application {
    static CognitoUserPool pool;
    static String userEmail;
    public void onCreate(){
        super.onCreate();
        pool = new CognitoUserPool(this,
                "us-east-xxxx",
                "xxxx",
                "xxxx",
                new ClientConfiguration(),
                Regions.US_EAST_1);
    }
}

-

private void actionAdminLogin(){
        UtilityInterfaceTools.hideSoftKeyboard(AdminLoginActivity.this);
        String inputEmail = ((EditText) findViewById(R.id.input_admin_email)).getText().toString();
        String inputPassword = ((EditText) findViewById(R.id.input_admin_password)).getText().toString();
        CognitoController.userEmail = inputEmail;
        details = new AuthenticationDetails(inputEmail, inputPassword, null);

        AuthenticationHandler auther = new AuthenticationHandler() {
            @Override
            public void onSuccess(CognitoUserSession userSession, CognitoDevice newDevice) {
                Toast.makeText(AdminLoginActivity.this, "Congratulations It Works...", Toast.LENGTH_LONG).show();
                startActivity(new Intent(AdminLoginActivity.this, AdminPortalActivity.class));
                finish();
            }

            @Override
            public void getAuthenticationDetails(AuthenticationContinuation continuation, String email) {
                continuation.setAuthenticationDetails(details);
                continuation.continueTask();
            }

            @Override
            public void getMFACode(MultiFactorAuthenticationContinuation continuation) {
                continuation.continueTask();
            }

            @Override
            public void authenticationChallenge(ChallengeContinuation continuation) {
                continuation.continueTask();
            }

            @Override
            public void onFailure(Exception exception) {
                TextView errorMessage = findViewById(R.id.message_invalid_credentials);
                errorMessage.setText(exception.toString());
                errorMessage.setVisibility(View.VISIBLE);
            }
        };
        CognitoController.pool.getUser(inputEmail).getSessionInBackground(auther);
    }

Answer 1

我认为你的问题(顺便说一下这不是问题)是:

1. 在您的池 Cognito 设置中，您将设备选择为 remembered .

Remembered

devices are also tracked. During user authentication, the key and secret pair assigned to a remembered device is used to authenticate the device to verify that it is the same device that the user previously used to sign in to the application. APIs to see remembered devices have been added to new releases of the Android, iOS, and JavaScript SDKs. You can also see remembered devices from the Amazon Cognito console.

1. token 已经是cached :

Caching

The Mobile SDK for Android caches the last successfully authenticated user and the user's tokens locally on the device, in SharedPreferences. The SDK also provides methods to get the last successfully authenticated user.

您的应用更新

事实上，为了更好的用户体验，您希望用户使用该应用程序，而不是每次她想使用您的应用程序时都需要登录(例如，查看邮件应用程序、社交媒体应用程序等) .但是，您的应用程序需要处理它，您在这里有两个选择:

1. 必要时重定向到登录:如果用户已经登录并想再次使用该应用程序，您的应用程序需要根据 Cognito 用户池验证用户，然后才, 如有必要，将用户重定向到登录页面。

2. 删除 token :如果您真的希望用户每次使用该应用程序时都登录，则在用户注销时删除 token ；但为了用户体验，我不推荐这样做。