flask-cognito

library1.21pypypi✓ verified 86d ago

Flask extension for authenticating users to AWS Cognito user pools using JWT tokens. Version 1.21 is current; release cadence is irregular.

security

pip install flask-cognito

github ↗homepage ↗

INSTALL

IMPORT

SIG · FLASK-COGNITO

flask-cognito

securitypythonv1.21

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

CognitoAuth

✓ from flask_cognito import CognitoAuth

✗ from flask_cognito import cognito

Old import path or mistaken module name.

cognito_auth_required

✓ from flask_cognito import cognito_auth_required

✗ from flask_cognito.auth import cognito_auth_required

Function is exposed at package level.

current_cognito_jwt

✓ from flask_cognito import current_cognito_jwt

✗ from flask import g

Use the provided object, not Flask's g for JWT payload.

Initialize CognitoAuth with Flask app config (region, domain, pool ID, client ID) and protect routes with @cognito_auth_required.

import os from flask import Flask from flask_cognito import CognitoAuth, cognito_auth_required app = Flask(__name__) app.config['AWS_DEFAULT_REGION'] = os.environ.get('AWS_DEFAULT_REGION', 'us-east-1') app.config['AWS_COGNITO_DOMAIN'] = os.environ.get('AWS_COGNITO_DOMAIN', 'https://your-domain.auth.us-east-1.amazoncognito.com') app.config['AWS_COGNITO_USER_POOL_ID'] = os.environ.get('AWS_COGNITO_USER_POOL_ID', '') app.config['AWS_COGNITO_CLIENT_ID'] = os.environ.get('AWS_COGNITO_CLIENT_ID', '') cogauth = CognitoAuth(app) @app.route('/protected') @cognito_auth_required def protected(): return 'Hello, user!' if __name__ == '__main__': app.run()

Debug

Known issues

breakingFlask-Cognito 1.x uses PyJWT 2.x; older versions of PyJWT may cause signature verification failures.

fix

Ensure PyJWT >=2.0 and cryptography are installed.

affects: >=1.0

gotchaThe AWS_COGNITO_DOMAIN must include the https:// prefix, otherwise token retrieval fails.

fix

Set app.config['AWS_COGNITO_DOMAIN'] = 'https://your-domain.auth.region.amazoncognito.com'

affects: all

gotchaFlask-Cognito only supports RS256 JWTs; HS256 or other algorithms will cause decode errors.

fix

Configure your Cognito User Pool to use RS256 signing.

affects: all

deprecatedThe 'cognito_auth_required' decorator does not accept arguments; use separate decorators for group-based access (e.g. '@cognito_group_check') if needed.

fix

For group checks, use cognito_group_check decorator with allowed_groups parameter.

affects: all

gotchaCognitoAuth must be initialized after all app config is set; else config defaults are missed.

fix

Set config values before calling CognitoAuth(app).

affects: all

Errors

Common errors & fixes

AttributeError: module 'flask_cognito' has no attribute 'CognitoAuth'

Incorrect import or outdated library version.

fix

Run 'pip install --upgrade flask-cognito' and use 'from flask_cognito import CognitoAuth'.

jwt.exceptions.InvalidKeyError: Signature verification failed

PyJWT version mismatch or wrong public key fetched; or algorithm not RS256.

fix

Install PyJWT>=2.0, cryptography; ensure Cognito app client is configured for RS256.

Flask-Cognito requires app context

Using decorator outside of request context; or no app set up.

fix

Ensure route function is within Flask app context; do not call current_cognito_jwt outside request.

KeyError: 'AWS_COGNITO_DOMAIN'

Missing configuration variables.

fix

Set all required config: AWS_DEFAULT_REGION, AWS_COGNITO_DOMAIN, AWS_COGNITO_USER_POOL_ID, AWS_COGNITO_CLIENT_ID.

Upgrade

Version history

1.21latest on PyPI · released Apr 13, 2024

Audit

Dependencies

FlaskrequiredCore dependency: Flask web framework.

PyJWTrequiredJWT decoding and verification.

cryptographyrequiredRequired for RS256 signature verification.

Agent activity

16 hits · last 30 days

node

Resources

githubhttps://github.com/jetbridge/flask_cognito ↗

homepagehttps://github.com/jetbridge/flask_cognito ↗