如何在 Electron JS 中从 Cognito OAuth2.0 动态获取 AccessToken

Question

您好，我将 Electron JS 用于桌面应用程序，该应用程序与需要从中获取患者列表的云平台相关。

就目前而言，我可以使用静态 AccessToken 来获取它。我真的很难让它动态化，请帮忙。

这是我的代码：

这是我指定 Cognito 参数的配置文件：

export default {
s3: {
  REGION: 'YOUR_S3_UPLOADS_BUCKET_REGION',
  BUCKET: 'YOUR_S3_UPLOADS_BUCKET_NAME',
},
apiGateway: {
  REGION: 'YOUR_API_GATEWAY_REGION',
  URL: 'YOUR_API_GATEWAY_URL',
},
cognito: {
  REGION: 'eu-west-1',
  USER_POOL_ID: 'eu-west-1_P0Jcr7nig',
  APP_CLIENT_ID: '4m1utu56hjm835dshts9jg63ou',
  IDENTITY_POOL_ID: 'YOUR_IDENTITY_POOL_ID',
  authenticationFlowType: 'USER_PASSWORD_AUTH',
  AUTHENTICATION_FLOW_TYPE: 'USER_PASSWORD_AUTH',
},
API: {
    endpoints: [
      {
        name: 'PatientsList',
        endpoint: 'https://uo992r7huf.execute-api.eu-west-1.amazonaws.com/Stage/patients',
        //endpoint: 'https://uo992r7huf.execute-api.eu-west-1.amazonaws.com/Stage',
      },
    ],
  },
};

Auth.signIn({
 username: process.env.username,
 password: process.env.password,
}).then().catch(err => {
 console.log(err)});

在另一个文件中，这是我导出到主文件的 getaccesstoken 函数

function getAccessToken() {
 const poolData = { 
  UserPoolId : COGNITO_USER_POOL_ID,
 ClientId : COGNITO_CLIENT_ID,
};
const userPool = new CognitoUserPool(poolData);
var authenticationData = {
      Username : process.env.username, // your username here
      Password : process.env.password, // your password here,
      authenticationFlowType: process.env.AUTHENTICATION_FLOW_TYPE,
      Pool : userPool
  };
  var authenticationDetails = new AmazonCognitoIdentity.AuthenticationDetails(
    authenticationData);
  var cognitoUser = new CognitoUser(authenticationData);
  cognitoUser.authenticateUser(authenticationDetails, {
      onSuccess: function (result) {
        console.log('access token + ' + result.getAccessToken().getJwtToken());
      },
      onFailure: function(err) {
       console.log(err);
      },
  });
}

最后是我如何在 main 中获取数据：

声明：

  const  { Auth } = require('./cognitoAuth');
 const theAccessToken = require('./cognitoAuth');

代码：

  //Get Data From Cloud ECS
  const API_URL = 'https://uo992r7huf.execute-api.eu-west-1.amazonaws.com/Stage/patients';
  const headers = {
    "Content-Type": "application/json",
    //Authorization: theAccessToken.getAccessToken()
    Authorization: "eyJraWQiOiJBbE1DZnBCTHYyVUlNazhXSG4xaTk4RG1QNlFmcFpSSjFaSW1qcVVFZnVBPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiI4OWYyZGMxZi1iMTI3LTQzM2QtODJhYS1iMjNkNWJhNzY5NGEiLCJjb2duaXRvOmdyb3VwcyI6WyJkb2N0b3IiXSwiZXZlbnRfaWQiOiI1OTM0ZmIwNC0yYTUzLTQ2NmQtYTU1Ni0zNTM3M2RhZmU1Y2UiLCJ0b2tlbl91c2UiOiJhY2Nlc3MiLCJzY29wZSI6ImF3cy5jb2duaXRvLnNpZ25pbi51c2VyLmFkbWluIiwiYXV0aF90aW1lIjoxNTk1NDI2NjQ2LCJpc3MiOiJodHRwczpcL1wvY29nbml0by1pZHAuZXUtd2VzdC0xLmFtYXpvbmF3cy5jb21cL2V1LXdlc3QtMV9QMEpjcjduaWciLCJleHAiOjE1OTcxNTUxMDUsImlhdCI6MTU5NzE1MTUwNSwianRpIjoiNGRkN2U5ZGUtYmQ2YS00NTg4LWIzZDAtMTVjMWM1NWQxY2Y2IiwiY2xpZW50X2lkIjoiNG0xdXR1NTZoam04MzVkc2h0czlqZzYzb3UiLCJ1c2VybmFtZSI6Ijg5ZjJkYzFmLWIxMjctNDMzZC04MmFhLWIyM2Q1YmE3Njk0YSJ9.LYvzPRBxvKw2P3gHwV8NhYPg_EB3F7ZK2F5HpRWHtBHksr6D4N5Fw56ZVupkRCxVJSq0f93DdljI7BBcBnp9d_hpLzmJLTfBhA3t870omTxalTqpGXN_SvsZmuwcfCX-awn1Um6x_-fhq3zcfPkB9FBljbtwPN-kvCc-Iynei9anVxXI686nIbkfbYfnuRnHrbY0vg8FtyDIDBMv277FPoJ96NwPD4mJvNBxQHi_KfWxQ1DmLiAC6c_l2jP_wawAPBv788CjD_8OlKBbjAHinGEkaL1K9vjI5MhNPyTA5ym1IaWar7Jr8RkUDzQGvqEUPKoOUe9PswmOOxLBjehMgQ"
    };
    //console.log('Token Value:', theAccessToken.getAccessToken());
    const getPatients = async(API_URL) => {
      try {
        //get data from cloud specifiying get method and headers which contain token
        const response = await fetch(API_URL,{
          method: 'GET', headers: headers}
          );
        var listPatients = await response.json();
        listPatients.items.forEach(patient => {
          //Checking what i got
          console.log(patient);
        });
        } catch(err) {
          console.log("Error" + err);
        }
        };
       getPatients(API_URL);

现在，当我通过指定 AccessToken.getAccessToken 使其成为动态时 我收到此错误，即使指定了 USER_SRP 也未启用，当我问团队告诉我云服务不想启用它时。 那么我该如何获得这个访问令牌呢？

Answer 1

对于桌面应用程序，建议按照security guidance 执行以下两件事：

• 使用授权码流 (PKCE)
• 通过系统浏览器登录，让应用永远看不到用户的密码

我有几个使用 Cognito 的 Electron 代码示例，您可以轻松运行它们 - 也许从这里开始：

• First desktop app