amazon-web-services - 赋予用户在 Cognito 中重置过期临时密码的能力

Question

我知道管理员可以使用以下命令从控制台重置用户的临时密码

aws cognito-idp admin-create-user --region us-east-1 --user-pool-id us-east-1_youruserpoolid --username theusername --message-action RESEND

但在这里我需要用户有触发选项的东西，并且在触发之后他应该为他的电子邮件获取新的临时密码。它有点像自助服务选项，用户不必调用管理员来重置他的临时密码。

我尝试使用 resendConfirmationCode 来自

https://github.com/aws-amplify/amplify-js/blob/master/packages/amazon-cognito-identity-js/src/CognitoUser.js

有要求:

{ClientId: "v3miuf2k********", Username: "suni*********"}

得到的回应是:

{code: "NotAuthorizedException", name: "NotAuthorizedException", message:  "Can't resend confirmation code for this user"}

code: "NotAuthorizedException"
message: "Can't resend confirmation code for this user"
name: "NotAuthorizedException"

Answer 1

只是想发布 AWS 支持的官方回复，如果将来有人需要答案。

1. I can see the error is caused by the API resendConfirmationCode which supposed to be called without any credentials, however, the error indication message said "NotAuthorizedException". Is this API called many times? That may trigger AWS backend side protection of anonymous attacking.

2. Can you have a try to create a new user with the same email and use the same API to send confirmation code? If there is an existing user with the same email address but not confirmed, it's fine to create a new user with the same email address.