Amazon Cognito

Overview

Amazon Cognito is a user identity and authentication service from AWS that handles registration, login, session management, and federated authentication for web and mobile applications. When detected on a website, it indicates the site uses Cognito to manage user accounts, authenticate sessions, and potentially federate login through social identity providers like Google, Facebook, or Apple.

What This Script Does

Amazon Cognito loads the AWS Amplify authentication libraries or the standalone Cognito Identity SDK, typically from cognito-idp.{region}.amazonaws.com and cognito-identity.{region}.amazonaws.com endpoints. The SDK manages the complete authentication lifecycle:

1. User registration — Collects username, password, and required attributes; sends them to Cognito User Pools for account creation with server-side password hashing
2. Authentication — Handles Secure Remote Password (SRP) protocol exchange for login, returning JWT tokens (ID token, access token, refresh token)
3. Session management — Stores JWT tokens in the browser, typically using localStorage under keys prefixed with CognitoIdentityServiceProvider.{clientId} containing the ID token, access token, refresh token, and user metadata
4. Token refresh — Automatically refreshes expired access tokens using the stored refresh token, maintaining seamless authenticated sessions
5. MFA — Supports TOTP and SMS-based multi-factor authentication flows
6. Federation — Redirects to external identity providers (Google, Facebook, Apple, SAML) and processes OAuth callback tokens

Storage used includes:

• localStorage entries under CognitoIdentityServiceProvider.* — storing JWT tokens (ID, access, refresh) and last authenticated user metadata; tokens typically expire in 1 hour (access/ID) with refresh tokens valid for 30 days
• localStorage entries under aws.cognito.identity-* — storing Cognito Identity Pool credentials for AWS service access

Cognito does not set advertising cookies, track browsing behavior, or share data with third parties. All data processing is scoped to the website's own user authentication and session management. Network requests go only to AWS Cognito service endpoints within the configured AWS region.

Consent & Compliance

Amazon Cognito is classified as essential. It is an authentication and identity management service — core infrastructure required for users to log in, maintain sessions, and access protected content.

Under the GDPR, processing authentication data has a clear legal basis in contract performance (Article 6(1)(b)). Users who create accounts and log in are explicitly engaging with the service, and processing their credentials and session data is necessary to deliver that service. User pool data (email, phone, custom attributes) must be covered in the website's privacy notice.

Under the ePrivacy Directive, the JWT tokens and session data stored in localStorage are strictly necessary for a service explicitly requested by the user (logging in and maintaining their session). Article 5(3) exempts such storage from consent requirements.

Under CCPA/CPRA, Cognito processes personal information (user credentials, identity tokens) solely for authentication purposes. AWS acts as a service provider under the website operator's DPA. No personal information is sold or shared for advertising.

Should You Block This Without Consent?

No. Amazon Cognito is authentication infrastructure. Blocking it would prevent users from logging in, registering accounts, and maintaining sessions — fundamentally breaking the website's user access system. It stores only authentication tokens, performs no tracking, and has no advertising function.