Cognito With the Safety Off: MFA Disabled, Advanced Security Disabled
✓ Human-authored analysis; AI used for formatting and proofreading. A Cognito user pool is an identity perimeter. The pool authenticates customers, issues JWTs the application trusts, and brokers federation to social identity providers. Whatever else the application does for security such as encryption-at-rest, network isolation, audit logging has the user pool decide whether this session gets to…
When creating a Cognito user pool, two security settings are disabled by default: Multi-Factor Authentication (MFA) and Advanced Security. These defaults are simple to adjust later, but they can leave applications vulnerable to various attacks. With MFA disabled, attackers can easily gain access through credential stuffing, password spraying, or phishing-recovered passwords.
Advanced Security, when turned off, prevents the risk model from running, which would detect unusual locations, impossible travel, and compromised credentials. The Bomma report on HackerOne demonstrated how these two settings together allowed an attacker to take over an account by resetting the password without needing the victim's MFA factor. To fix these issues, it is crucial to enforce MFA for customer-facing Cognito user pools.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
