{"categories":[{"label":"Cryptography","url":"https://skillfed.io/packages/category/security-cryptography"}],"enrichment":{"capability":"Decodes and verifies Amazon Cognito JWT tokens in both synchronous and asynchronous modes, validating signatures against AWS public key sets.","skillfed_tags":["aws-cognito","jwt-validation","authentication"],"use_cases":["Verify Cognito ID tokens in a Flask or FastAPI application protecting API endpoints.","Validate Cognito tokens asynchronously in event-driven or async Python applications.","Decode and extract claims from Cognito tokens for authorization decisions in microservices.","Test Cognito authentication flows locally by disabling token expiration checks.","Support applications deployed in private VPCs by loading JWKS from a local file instead of fetching from AWS."],"what_it_does":"cognitojwt is a lightweight library for validating Amazon Cognito ID tokens by decoding and verifying JWT signatures. It wraps python-jose to handle the cryptographic operations and fetches AWS public key sets (JWKS) to validate token signatures. The library supports both synchronous (using requests) and asynchronous (using aiohttp) modes, letting you choose based on your application architecture.\n\nThe package is designed for applications that need to verify Cognito tokens locally without making additional AWS API calls. It handles signature validation, token expiration checks (with an optional test mode to disable expiration), and supports single or multiple app client IDs. However, the repository is archived and no longer actively maintained, so it may not track changes to AWS Cognito's token format or security practices.","worth_installing":"Yes, but with caution. The package is straightforward and has no known vulnerabilities, making it suitable for projects that need basic Cognito token verification. However, it is abandoned (last release June 2021, repository archived), so you should verify that it remains compatible with your Python version and current Cognito token format. For new projects or those requiring active maintenance, consider whether AWS SDK or a maintained alternative better fits your risk tolerance."},"id":"cognitojwt","links":{"html":"https://skillfed.io/packages/cognitojwt","md":"https://skillfed.io/packages/cognitojwt.md","pypi":"https://pypi.org/project/cognitojwt/"},"maintenance":{"status":"abandoned"},"meta":{"latest_release":"2021-06-07","license_spdx":null,"license_treatment":"permissive","name":"cognitojwt","python_support":"unspecified","summary":"Decode and verify Amazon Cognito JWT tokens"},"popularity":{"monthly_downloads":548652,"position":6060,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"1.4.1"}