Zakaria/FlociClone
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(cognito): show the client's identity providers on the hosted login page

Browse Source 
The hosted login page now offers a "Continue with <provider>" button for each
of the app client's other SupportedIdentityProviders, carrying the same
authorize parameters (state, nonce, PKCE) into the federated flow, as Cognito's
managed login does. A client that lists only external providers gets the
buttons without the password form instead of an error.
This commit is contained in:
Zakaria
2026-10-24 12:14:04 -04:00
parent 2e7ebefca9
commit 174cb600d4
3 changed files with 84 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/services/cognito.md
+4 -1
View File
@@ -316,7 +316,10 @@ emulator-friendly client-credentials flow:
Without `identity_provider`, or with `identity_provider=COGNITO`, the pool's own users sign in
on the hosted login page; the client must list `COGNITO` in `SupportedIdentityProviders` (the
default when none are given).
- `GET /cognito-idp/login` shows a user name (or email) and password form. A correct password
- `GET /cognito-idp/login` shows a user name (or email) and password form when the client lists
`COGNITO`, and a "Continue with <provider>" button for each of its other
`SupportedIdentityProviders`, which starts the federated sign-in above with the same authorize
parameters. A correct password
redirects to the registered callback with a one-time authorization code and `state`, and starts
a one-hour browser session (the `cognito` cookie), so the next authorize request returns a code
without the form unless it sends `prompt=login`. Wrong passwords, unknown users and