How to Add Passkeys to Amazon Cognito

docker-compose up

frontend-structure
.
├── src
|   ├── app
|   |   ├── auth
|   |   |   ├── auth.component.html       # HTML structure for login/sign-up view with email and password input
|   |   |   ├── auth.component.ts         # Interacts with AuthService to login and sign-up
|   |   ├── ...
|   ├── logged-in
|   |   ├── logged-in.component.html      # HTML structure for logged-in view with main function to logout
|   |   ├── logged-in.component.ts        # Logout and go back to login/sign-up view
|   ├── app-routing.module.ts             # Routing
|   ├── app.component.html                # Display the page that is currently routed to
|   ├── auth.service.ts                   # Interaction with the backend to sign-up, login and logout
|   ├── ...
|   ├── assets
|   ├── index.html
|   ├── main.ts
|   ├── ...
├── ...

npm install -g @angular/cli

ng serve

backend-structure
.
├── controllers
|   ├── authCognitoController.ts      # Controller that handles the communication with Amazon Cognito
├── app.ts                             # Our server that handles the routing to the controller
├── ...

npm install

npm run dev

defineCorbadoAuthChallenge.js
export const handler = async (event) => {
    // This if statement checks if the event object contains a session array property that is empty. If it is
    // empty, it means that the authentication flow has just started, so the customChallenge function is
    // called to send a custom challenge.
    if (!event.request.session.length) {
        return customChallenge(event);
    }
 
    // This if statement checks if any of the previous authentication attempts in the session array had a
    // challengeName property that is not equal to "CUSTOM_CHALLENGE". If there was an attempt that
    // used a different challenge type, the deny function is called with an error message.
    if (
        event.request.session.find(
            (attempt) => attempt.challengeName !== "CUSTOM_CHALLENGE",
        )
    ) {
        return deny(event, "Expected CUSTOM_CHALLENGE");
    }
 
    // This code block handles the authentication response from the client. It checks the last item in the
    // session array to see if the challengeResult property is true. If it is true, the authentication is
    // considered successful, so the allow function is called to allow the user. If the challengeResult is not
    // true, the function checks if the maximum number of failed attempts has been reached
    // (determined by the countAttempts function). If the maximum number has not been reached, the
    // customChallenge function is called to send another custom challenge. Otherwise, the deny function
    // is called to deny the authentication request with an error message.
    const lastResponse = event.request.session.slice(-1)[0];
    if (lastResponse.challengeResult === true) {
        return allow(event);
    } else if (countAttempts(event, false) === 0) {
        return customChallenge(event);
    }
    return deny(event, "Failed to authenticate with passkeys");
};
 
// These are the helper functions used in the main handler function. deny is called to deny the
// authentication request with an error message. Allow is called to allow the user if the authentication
// is successful. customChallenge is called to send a custom challenge to the user.
function deny(event, reason) {
    event.response.issueTokens = false;
    event.response.failAuthentication = true;
    console.log("Authentication denied!");
    return event;
}
 
function allow(event) {
    event.response.issueTokens = true;
    event.response.failAuthentication = false;
    console.log("Authentication allowed!");
    return event;
}
 
function customChallenge(event) {
    event.response.issueTokens = false;
    event.response.failAuthentication = false;
    event.response.challengeName = "CUSTOM_CHALLENGE";
    return event;
}
 
// The countAttempts function returns the number of authentication attempts stored in the session array of the event
// object passed to the Lambda function. It optionally filters out any authentication attempts that used
// the PROVIDE_AUTH_PARAMETERS challenge type. This function is used in the handler function to determine if the
// maximum number of failed attempts has been reached, and if so, to deny the authentication request.
function countAttempts(event, excludeProvideAuthParameters = true) {
    if (!excludeProvideAuthParameters) return event.request.session.length;
    return event.request.session.filter(
        (entry) => entry.challengeMetadata !== "PROVIDE_AUTH_PARAMETERS",
    ).length;
}

createCorbadoAuthChallenge.js
// This function generates a random challenge string and returns a response object containing the challenge string
// and other necessary parameters for the custom authentication flow to proceed.
export const handler = async (event) => {
    const challenge = Math.random().toString(36).substring(7);
 
    event.response = {
        challengeMetadata: "CORBADO_CHALLENGE_COGNITO_CLAIM",
        // Cognito requires at least one public param
        publicChallengeParameters: {
            challenge: challenge,
        },
        privateChallengeParameters: {
            challenge: challenge,
        },
    };
 
    return event;
};

verifyCorbadoAuthChallenge.js
export const handler = async (event) => {
    if (
        !event.request.privateChallengeParameters ||
        event.request.privateChallengeParameters.challenge !==
            event.request.challengeAnswer
    ) {
        event.response.answerCorrect = false;
        return event;
    }
 
    console.log("Successfully authenticated!");
    event.response.answerCorrect = true;
 
    return event;
};

index.html
<!doctype html>
<html lang="en">
    <head> </head>
    <body>
        <script src="https://<Project ID>.frontendapi.corbado.io/auth.js"></script>
        <app-root></app-root>
    </body>
</html>

auth.component.html
<corbado-auth project-id="<Project ID>" conditional="yes">
    <input name="username" id="corbado-username" required autocomplete="webauthn" />
</corbado-auth>

app.module.ts
import { CUSTOM_ELEMENTS_SCHEMA, NgModule } from "@angular/core";
import { BrowserModule } from "@angular/platform-browser";
import { FormsModule } from "@angular/forms";
import { HttpClientModule } from "@angular/common/http";
import { AppRoutingModule } from "./app-routing.module";
import { AppComponent } from "./app.component";
import { AuthComponent } from "./auth/auth.component";
import { LoggedInComponent } from "./logged-in/logged-in.component";
 
@NgModule({
    declarations: [AppComponent, AuthComponent, LoggedInComponent],
    imports: [BrowserModule, FormsModule, AppRoutingModule, HttpClientModule],
    providers: [],
    bootstrap: [AppComponent],
    schemas: [CUSTOM_ELEMENTS_SCHEMA],
})
export class AppModule {}

auth.component.ts
import { Component, OnInit } from "@angular/core";
import { ActivatedRoute, Router } from "@angular/router";
import { AuthService } from "../auth.service";
import { Subscription } from "rxjs";
 
@Component({
    selector: "app-auth",
    templateUrl: "./auth.component.html",
    styleUrls: ["./auth.component.scss"],
})
export class AuthComponent implements OnInit {
    email = "";
    password = "";
    errorMessage = "";
    queryParamsSubscription!: Subscription;
 
    constructor(
        private authService: AuthService,
        private router: Router,
        private route: ActivatedRoute,
    ) {
        this.queryParamsSubscription = this.route.queryParams.subscribe((queryParams) => {
            if (queryParams["corbadoAuthToken"] != undefined) {
                let corbadoAuthToken = queryParams["corbadoAuthToken"];
                this.authService
                    .corbadoAuthTokenValidate(corbadoAuthToken)
                    .then((res) => {
                        router.navigate(["/logged-in"]);
                    })
                    .catch((error) => console.log(error));
            }
        });
    }
 
    ngOnInit(): void {}
 
    // ...
}

auth.service.ts
import { Injectable } from "@angular/core";
import { HttpClient } from "@angular/common/http";
import { Router } from "@angular/router";
import { map, Observable, Subject } from "rxjs";
 
@Injectable({
    providedIn: "root",
})
export class AuthService {
    private isAuthenticated = false;
    private authStatusListener = new Subject<boolean>();
    private token: string = "";
    private userId: string = "";
 
    constructor(
        private http: HttpClient,
        private router: Router,
    ) {}
 
    getToken() {
        return this.token;
    }
 
    getUserId() {
        return this.userId;
    }
 
    getAuthStatusListener() {
        return this.authStatusListener.asObservable();
    }
 
    // ...
 
    logout() {
        this.token = "";
        this.isAuthenticated = false;
        this.authStatusListener.next(false);
        this.router.navigate(["/login"]);
    }
 
    getIsAuth() {
        return this.isAuthenticated;
    }
 
    async corbadoAuthTokenValidate(corbadoAuthToken: string) {
        try {
            this.http
                .get<{
                    idToken: string;
                }>(
                    `http://localhost:3000/api/corbado/authTokenValidate?corbadoAuthToken=${corbadoAuthToken}`,
                )
                .subscribe((responseData) => {
                    const token = responseData.idToken;
                    this.token = token;
                    if (token) {
                        this.isAuthenticated = true;
                        this.authStatusListener.next(true);
                        this.router.navigate(["/logged-in"]);
                    }
                });
        } catch (error) {
            console.error(error);
            throw error;
        }
    }
}

npm install corbado corbado-webhook --save

authCorbadoController.ts
import { Request, Response } from "express";
// @ts-ignore
import crypto from "crypto";
// @ts-ignore
import jwt from "jsonwebtoken";
import {
    verifyPassword,
    getUserStatus,
    createUser,
    createSession,
} from "./authCognitoController";
import { NOT_EXISTS } from "../utils/constants";
const Corbado = require("@corbado/node-sdk");
 
require("dotenv").config({ path: "../.env" });
 
// Corbado Node.js SDK
const CORBADO_PROJECT_ID = process.env.CORBADO_PROJECT_ID;
const CORBADO_API_SECRET = process.env.CORBADO_API_SECRET;
const config = new Corbado.Configuration(CORBADO_PROJECT_ID, CORBADO_API_SECRET);
const corbado = new Corbado.SDK(config);
 
export const handleWebhook = async (req: Request, res: Response) => {
    try {
        // Get the webhook action and act accordingly. Every Corbado
        // webhook has an action.
 
        let request: any;
        let response: any;
        console.log("BEFORE ACTION");
        switch (corbado.webhooks.getAction(req)) {
            // Handle the "authMethods" action which basically checks
            // if a user exists on your side/in your database.
            case corbado.webhooks.WEBHOOK_ACTION.AUTH_METHODS: {
                console.log("WEBHOOK AUTH METHODS");
                request = corbado.webhooks.getAuthMethodsRequest(req);
 
                // Now check if the given user/username exists in your
                // database and send status. Implement getUserStatus()
                // function below.#
                console.log("BEFORE USER STATUS");
 
                const status = await getUserStatus(request.data.username);
                let correctUserStatus = status.userStatus;
                if (status.createdByCorbado) {
                    correctUserStatus = "not_exists";
                }
                response = corbado.webhooks.getAuthMethodsResponse(correctUserStatus);
                res.json(response);
                break;
            }
 
            // Handle the "passwordVerify" action which basically checks
            // if the given username and password are valid.
            case corbado.webhooks.WEBHOOK_ACTION.PASSWORD_VERIFY: {
                console.log("WEBHOOK PASSWORD VERIFY");
                request = corbado.webhooks.getPasswordVerifyRequest(req);
 
                // Now check if the given username and password is
                // valid. Implement verifyPassword() function below.
                const isValid = await verifyPassword(
                    request.data.username,
                    request.data.password,
                );
                response = corbado.webhooks.getPasswordVerifyResponse(isValid);
                res.json(response);
                break;
            }
            default: {
                res.status(400).send("Bad Request");
                return;
            }
        }
    } catch (error: any) {
        // We expose the full error message here. Usually you would
        // not do this (security!) but in this case Corbado is the
        // only consumer of your webhook. The error message gets
        // logged at Corbado and helps you and us debugging your
        // webhook.
        console.log(error);
 
        // If something went wrong just return HTTP status
        // code 500. For successful requests Corbado always
        // expects HTTP status code 200. Everything else
        // will be treated as error.
 
        res.status(500).send(error.message);
        return;
    }
};
 
export const authTokenValidate = async (req: Request, res: Response) => {
    console.log("AUTH TOKEN VALIDATE STARTED");
 
    try {
        let corbadoAuthToken = req.query["corbadoAuthToken"] as string;
        let clientInfo = corbado.utils.getClientInfo(req);
        let corbadoUser = await corbado.authTokens.validate(corbadoAuthToken, clientInfo);
        let username = JSON.parse(corbadoUser.data.userData).username;
        const status = await getUserStatus(username);
        console.log("USER EXISTS: ", status.userStatus);
 
        // if the user does not yet exist in AWS Cognito, add him in AWS Cognito
        if (status.userStatus === NOT_EXISTS) {
            console.log("CREATING USER...");
            await createUser(username);
        }
 
        // create an AWS Session
        console.log("GET AWS COGNITO SESSION TOKEN");
        let data = await createSession(username);
 
        res.json(data);
    } catch (error: any) {
        console.log(error);
        res.status(500).send(error.message);
    }
};

app.ts
// ...
 
// Old authentication process for Amazon Cognito
//app.post('/api/auth/signup', signUp);
//app.post('/api/auth/login', login);
app.post("/api/auth/logout", logout);
 
// Corbado passkey-first authentication
const projectID = process.env.CORBADO_PROJECT_ID;
const apiSecret = process.env.CORBADO_API_SECRET;
const corbadoWebhookUsername = process.env.CORBADO_WEBHOOK_USERNAME;
const corbadoWebhookPassword = process.env.CORBADO_WEBHOOK_PASSWORD;
 
const config = new Corbado.Configuration(projectID, apiSecret);
config.webhookUsername = corbadoWebhookUsername;
config.webhookPassword = corbadoWebhookPassword;
const corbado = new Corbado.SDK(config);
 
app.post("/api/corbado/webhook", corbado.webhooks.middleware, json(), handleWebhook);
app.get("/api/corbado/authTokenValidate", json(), authTokenValidate);
 
app.get("/ping", (req: Request, res: Response) => {
    res.send("pong");
});
 
const port = process.env.PORT || 3000;
 
app.listen(port, () => {
    console.log(`Server started on port ${port}`);
});

authCognitoController.ts
import { Request, Response } from "express";
import {
    AdminCreateUserCommand,
    AdminCreateUserCommandInput,
    AdminGetUserCommand,
    AdminGetUserCommandInput,
    AdminInitiateAuthCommand,
    AdminInitiateAuthCommandInput,
    AdminSetUserPasswordCommand,
    AdminSetUserPasswordCommandInput,
    AttributeType,
    AuthFlowType,
    ChallengeNameType,
    CognitoIdentityProviderClient,
    CognitoIdentityProviderClientConfig,
    GlobalSignOutCommand,
    InitiateAuthCommand,
    InitiateAuthCommandInput,
    InitiateAuthCommandOutput,
    MessageActionType,
    RespondToAuthChallengeCommand,
    RespondToAuthChallengeCommandInput,
    RespondToAuthChallengeCommandOutput,
} from "@aws-sdk/client-cognito-identity-provider";
// @ts-ignore
import crypto from "crypto";
// @ts-ignore
import { hashSecret, validateJWT, generatePassword } from "../utils/helper";
import { EXISTS, NOT_EXISTS } from "../utils/constants";
 
require("dotenv").config({ path: "../.env" });
 
const userPoolId = process.env.COGNITO_USER_POOL_ID;
const clientId = process.env.COGNITO_CLIENT_ID || "";
const clientSecret = process.env.COGNITO_CLIENT_SECRET || "";
const region = process.env.COGNITO_REGION || "";
const poolData = { UserPoolId: userPoolId, ClientId: clientId };
 
const clientConfig: CognitoIdentityProviderClientConfig = {
    region: region,
};
const client = new CognitoIdentityProviderClient(clientConfig);
 
// old Amazon Cognito code commented out
/*export const signUp = async (req: Request, res: Response) => {
    const {email, password} = req.body;
    // Workaround, as don't want to send out confirm emails
    const paramsAdminCreateUser: AdminCreateUserCommandInput = {
        ...poolData,
        Username: email,
        DesiredDeliveryMediums: ["EMAIL"],
        UserAttributes: [
            {Name: 'email', Value: email},
            {Name: 'email_verified', Value: 'true'},
        ],
        MessageAction: MessageActionType.SUPPRESS
    };
    try {
        const createUserCommand = new AdminCreateUserCommand(paramsAdminCreateUser);
        await client.send(createUserCommand);
        console.log("USER SUCCESSFULLY CREATED");
        const paramsSetUserPassword: AdminSetUserPasswordCommandInput = {
            ...poolData,
            Username: email,
            Permanent: true,
            Password: password
        };
        const confirmUserCommand = new AdminSetUserPasswordCommand(paramsSetUserPassword);
        await client.send(confirmUserCommand);
        console.log("USER SUCCESSFULLY CONFIRMED");
        res.status(200).json({message: 'User created successfully'});
    } catch (err) {
        console.log(err);
        res.status(500).json({message: 'An error occurred'});
    }
};
export const login = async (req: Request, res: Response) => {
    const {email, password} = req.body;
    const authParams = {
        ...poolData,
        AuthFlow: 'USER_PASSWORD_AUTH',
        AuthParameters: {
            USERNAME: email,
            PASSWORD: password,
            SECRET_HASH: ""
        },
    };
    const hash = hashSecret(clientSecret, email, clientId);
    if (hash && authParams.AuthParameters) {
        authParams.AuthParameters.SECRET_HASH = hash;
    }
    try {
        const initiateAuthCommand = new InitiateAuthCommand(authParams);
        const authResult = await client.send(initiateAuthCommand);
        if (!authResult.AuthenticationResult) {
            res.status(401).json({message: "Invalid credentials"});
            return;
        }
        res.status(200).json({token: authResult.AuthenticationResult.AccessToken});
    } catch (err) {
        console.log(err);
        res.status(401).json({message: 'Invalid credentials'});
    }
};*/
 
export const logout = async (req: Request, res: Response) => {
    const { token } = req.body;
    const params = {
        ...poolData,
        AccessToken: token,
    };
    try {
        const globalSignOutCommand = new GlobalSignOutCommand(params);
        await client.send(globalSignOutCommand);
        res.status(200).json({ message: "User logged out successfully" });
    } catch (err) {
        console.log(err);
        res.status(500).json({ message: "An error occurred" });
    }
};
 
export const verifyPassword = async (
    email: string,
    password: string,
): Promise<boolean> => {
    if (!(email?.trim() && password?.trim())) {
        console.log("Error with email or password");
        return false;
    }
    const params: InitiateAuthCommandInput = {
        ClientId: clientId,
        AuthFlow: AuthFlowType.USER_PASSWORD_AUTH,
        AuthParameters: {
            USERNAME: email,
            PASSWORD: password,
            SECRET_HASH: hashSecret(clientSecret, email, clientId) || "",
        },
    };
    try {
        const command = new InitiateAuthCommand(params);
        const output = (await client.send(command)) as InitiateAuthCommandOutput;
        return Boolean(output.AuthenticationResult);
    } catch (error) {
        console.log("Error authenticating user:", error);
        return false;
    }
};
 
interface UserAttributes {
    Name: string;
    Value: string;
}
 
export const getUserStatus = async (email: string) => {
    const params: AdminGetUserCommandInput = {
        ...poolData,
        Username: email,
    };
 
    try {
        const command = new AdminGetUserCommand(params);
        const response = await client.send(command);
 
        // We add a workaround for users, as users who have never been showed a password
        // exist in Cognito (with a random password). Therefore, we introduce the
        // custom variable "createdByCorbado" in the user pool which is stored on
        // every create user event caused by the Corbado web component.
 
        if (
            !response ||
            !response.UserAttributes ||
            !Array.isArray(response.UserAttributes)
        ) {
            throw new Error("Invalid response object");
        }
 
        let createdByCorbado: boolean = false;
 
        response.UserAttributes.forEach((attr: AttributeType | undefined) => {
            if (attr && attr.Name === "custom:createdByCorbado") {
                createdByCorbado = attr.Value === "true";
            }
        });
 
        // if Corbado has created the user in AWS Cognito, we send back that the user
        // is not an existing user in the sense, he existed prior to Corbado
        return {
            userStatus: EXISTS,
            createdByCorbado: createdByCorbado,
        };
    } catch (error: any) {
        if (error.name === "UserNotFoundException") {
            return {
                userStatus: NOT_EXISTS,
                createdByCorbado: false,
            };
        } else {
            throw error;
        }
    }
};
 
interface SessionInfo {
    email: string;
    cognitoUUID: string;
    name: string;
    expires: number;
    idToken: string;
    refreshToken: string;
}
 
export const createSession = async (username: string): Promise<SessionInfo> => {
    console.log("START CREATE SESSION");
    const params: AdminInitiateAuthCommandInput = {
        ...poolData,
        AuthFlow: AuthFlowType.CUSTOM_AUTH,
        ClientId: clientId,
        AuthParameters: {
            USERNAME: username,
            SECRET_HASH: hashSecret(clientSecret, username, clientId) || "",
        },
    };
 
    try {
        const adminInitiateAuthCommand = new AdminInitiateAuthCommand(params);
        const response = await client.send(adminInitiateAuthCommand);
 
        let answer = "FAILURE";
        if (response.ChallengeParameters) {
            answer = response.ChallengeParameters.challenge;
        }
 
        console.log("ANSWER:", answer);
        const respondToAuthChallengeCommand: RespondToAuthChallengeCommandInput = {
            ClientId: clientId,
            ChallengeName: ChallengeNameType.CUSTOM_CHALLENGE,
            ChallengeResponses: {
                ANSWER: answer,
                USERNAME: username,
                SECRET_HASH: hashSecret(clientSecret, username, clientId) || "",
            },
            Session: response.Session,
        };
 
        const AuthChallengeCommand = new RespondToAuthChallengeCommand(
            respondToAuthChallengeCommand,
        );
        const authResult = (await client.send(
            AuthChallengeCommand,
        )) as RespondToAuthChallengeCommandOutput;
 
        if (authResult?.AuthenticationResult) {
            const token = await validateJWT(
                authResult.AuthenticationResult.IdToken as string,
            );
            const user: any = token as any;
 
            return {
                email: user.email as string,
                cognitoUUID: user.sub,
                name: user.name,
                expires: user.exp,
                idToken: authResult.AuthenticationResult.IdToken as string,
                refreshToken: authResult.AuthenticationResult.RefreshToken as string,
            };
        } else throw Error("Failed to create session");
    } catch (error) {
        throw error;
    }
};
 
export const createUser = async (email: string) => {
    const params: AdminCreateUserCommandInput = {
        ...poolData,
        Username: email,
        DesiredDeliveryMediums: ["EMAIL"],
        UserAttributes: [
            { Name: "email", Value: email },
            { Name: "email_verified", Value: "true" },
            { Name: "custom:createdByCorbado", Value: "true" },
        ],
        MessageAction: MessageActionType.SUPPRESS,
    };
    try {
        const createUserCommand = new AdminCreateUserCommand(params);
        const responseCreateUserCommand = await client.send(createUserCommand);
 
        console.log("USER SUCCESSFULLY CREATED");
 
        const setPasswordParams: AdminSetUserPasswordCommandInput = {
            ...poolData,
            Username: email,
            Permanent: true,
            Password: generatePassword(15),
        };
        const confirmUserCommand = new AdminSetUserPasswordCommand(setPasswordParams);
        await client.send(confirmUserCommand);
        console.log("USER SUCCESSFULLY CONFIRMED");
 
        return responseCreateUserCommand;
    } catch (error: any) {
        console.log("Error during user creation: ", error);
        return false;
    }
};

constants.ts
export const EXISTS = "exists";
export const NOT_EXISTS = "not_exists";
export const BLOCKED = "blocked";

helper.ts
// @ts-ignore
import crypto from "crypto";
// @ts-ignore
import jwt from "jsonwebtoken";
import { int } from "aws-sdk/clients/datapipeline";
// @ts-ignore
import jwkToPem, { JWK } from "jwk-to-pem";
 
require("dotenv").config({ path: "../.env" });
 
const clientId = process.env.COGNITO_CLIENT_ID;
const region = process.env.COGNITO_REGION;
const envJWKS = process.env.COGNITO_JWKS;
const userPoolId = process.env.COGNITO_USER_POOL_ID;
const jwks: JWK[] | any[] = JSON.parse(envJWKS as string);
 
export function hashSecret(clientSecret: string, username: string, clientId: string) {
    if (!clientSecret) {
        return null;
    }
    return crypto
        .createHmac("SHA256", clientSecret)
        .update(username + clientId)
        .digest("base64");
}
 
export function validateJWT(jwtToken: string, skipExpiredCheck?: boolean) {
    let res;
    try {
        let pem = jwkToPem(jwks[0]);
        res = jwt.verify(jwtToken, pem, { algorithms: jwks[0].alg });
    } catch (error) {
        let pem = jwkToPem(jwks[1]);
        res = jwt.verify(jwtToken, pem, { algorithms: jwks[1].alg });
    }
 
    if (!jwtToken.trim()) {
        console.log("Error with JWT");
        return;
    }
    let decoded = jwt.decode(jwtToken);
    const now = +new Date() / 1000;
    // @ts-ignore
    if (!skipExpiredCheck && decoded.exp < now) {
        console.log("Token expired");
        return;
    }
    // @ts-ignore
    if (decoded.aud !== clientId) {
        console.log("Invalid audience in token");
        return;
    }
    // @ts-ignore
    if (decoded.iss !== `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`) {
        console.log("Invalid iss in token");
        return;
    }
    return res;
}
 
export function generatePassword(length: int) {
    const charset =
        "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+~`|}{[]:;?><,./-=";
    let password = "";
    for (let i = 0; i < length; i++) {
        const randomIndex = Math.floor(Math.random() * charset.length);
        password += charset[randomIndex];
    }
    return password;
}

corbado subscribe http://localhost:3000