aws-samples/amazon-cognito-passwordless-email-auth

how could you also simultaneously verify phones?

bionicles opened this issue · 2 comments

bionicles commented

Hey,

I'm just curious, do you think it would be possible to make a branch of this repo which also verifies the phone at the same time? That's the main thing holding me back from trusting cognito

Thanks for your work

bionicles commented

Also, I'd love to see future examples with CDK because then all the code could be in typescript instead of 50/50 yaml and typescript. One language focus for the win!

ottokruse commented

Excuse the belated response, here's an answer in case it is still relevant to you:

  • Verifying phone at the same time; as in two custom challenges? One to phone and the other to e-mail? Sounds like a very secure setup! It can be achieved indeed, however, let's keep this repo here as clean and simple as possible, so that it remains a solution that newcomers can easily understand and adopt. Maybe you can write a blog or so on doing it? I'd be very interested to read that, and link to that blog from here.

  • CDK examples: yes a good idea, however, to remain compatible with the serverless application repository for now plain CloudFormation is still the best way to go. (The CloudFormation should be easily translatable into CDK by the way).

Sorry for all the "howevers" - greatly appreciate your interest in this solution and that you spend the time asking questions and making suggestions here.

Closing this issue for now. Do not hesitate to raise issues like this in the future. Cheers.