Decoding AWS Cognito Token, How to swap out jsonwebtoken for jose?

[ilrein]

Hey folks,

I need to use this package instead of jsonwebtoken because it has support for Cloudflare Workers 💯

I am struggling to understand how it all works though. Here's my previous code:

const jwkToPem = require('jwk-to-pem')
const jwt = require('jsonwebtoken')

// https://cognito-idp.us-east-1.amazonaws.com/{userPoolId}/.well-known/jwks.json
const jwks = require('../config/jwks.json')

const ValidateToken = async (token) => {
  console.log('validating..');
  const pems = {}
  const keys = jwks.keys

  for (let i = 0; i < keys.length; i++) {
    // Convert each key to PEM
    const key_id = keys[i].kid
    const modulus = keys[i].n
    const exponent = keys[i].e
    const key_type = keys[i].kty
    const jwk = { kty: key_type, n: modulus, e: exponent }
    const pem = jwkToPem(jwk)
    pems[key_id] = pem
  }

  // validate the token
  const decodedJwt = jwt.decode(token, { complete: true })
  if (!decodedJwt) {
    // console.log('Not a valid JWT token')
    return false
  }

  const kid = decodedJwt.header.kid
  const pem = pems[kid]
  if (!pem) {
    // console.log('Invalid token')
    return false
  }

  return jwt.verify(token, pem, { algorithms: ['RS256'] }, function(err, payload) {
    if (err) {
      console.log(err);
      return err
    } else {
      return payload
    }
  })
}

export default ValidateToken

How would I swap out the functions used here to one's with jose instead? I think what I need is jose.createLocalJWKSet. I've tried this:

const jwkToPem = require('jwk-to-pem')
// const jwt = require('jsonwebtoken')
const jose = require('jose')

// https://cognito-idp.us-east-1.amazonaws.com/{userPoolId}/.well-known/jwks.json
const jwks = require('../config/jwks.json')

const ValidateToken = async (token, env) => {
  console.log(env);
  const JWKS = jose.createLocalJWKSet(jwks)

  const { payload, protectedHeader } = await jose.jwtVerify(token, JWKS, {
    issuer: `https://cognito-idp.us-east-1.amazonaws.com/${env.POOL_ID}`,
    audience: `${env.APP_CLIENT_ID}`
  })

  console.log(protectedHeader)
  console.log(payload)

  return payload
}

export default ValidateToken

But I get: Unhandled Promise Rejection: JWTClaimValidationFailed: unexpected "aud" claim value

According to AWS, this should be the correct issuer/audience:

The audience (aud) claim should match the app client ID that was created in the Amazon Cognito user pool.

The issuer (iss) claim should match your user pool. For example, a user pool created in the us-east-1 Region will have the following iss value: https://cognito-idp.us-east-1.amazonaws.com/USER_POOL_ID

[panva]

Not sure how to assist. The audience is different than the one you ask it to be...

Also your jsonwebtoken code did not check the audience at all...

[panva]

And your local jwks should be cached and not called on every validation.