{"_id":"cognito-srp","_rev":"3-c7ac772ad568d59b94fac13226d80254","name":"cognito-srp","description":"Secure Remote Password protocol implementation compatible with Amazon Cognito.","dist-tags":{"latest":"0.2.0"},"versions":{"0.1.0":{"name":"cognito-srp","version":"0.1.0","description":"Secure Remote Password protocol implementation compatible with Amazon Cognito.","main":"dist/lib/index.js","types":"dist/lib/index.d.ts","scripts":{"test":"jest --config=jest.config.json","prepublish":"tsc"},"author":{"name":"Stewart MacKenzie-Leigh"},"license":"ISC","devDependencies":{"@types/jest":"^22.1.1","@types/jsbn":"^1.2.29","jest":"^22.1.4","ts-jest":"^22.0.3","typescript":"^2.7.1"},"dependencies":{"jsbn":"^1.1.0"},"repository":{"type":"git","url":"git+https://github.com/stewartml/cognito-srp.git"},"keywords":["amazon","aws","cognito","srp","identity","auth"],"bugs":{"url":"https://github.com/stewartml/cognito-srp/issues"},"homepage":"https://github.com/stewartml/cognito-srp#readme","gitHead":"a13bc7295aafc62d66b810ea243046c0178018d1","_id":"cognito-srp@0.1.0","_npmVersion":"5.6.0","_nodeVersion":"8.9.0","_npmUser":{"name":"stewartml","email":"stewartml@gmail.com"},"dist":{"integrity":"sha512-qHi98/RYIvtdwc7pYsUa5e4dBh5Nv70MMdtl+/uTOhAkuApNj2PG+HYHHJGxjgISqhMkt2T5Q/gAMJg3O2atWg==","shasum":"8324095056b1cdd48a3d31ba6b00d9db686f14b9","tarball":"https://registry.npmjs.org/cognito-srp/-/cognito-srp-0.1.0.tgz","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQCJgLoJ7or6FzxT7SUIxzmzGOBA8u/+lS6CXI28fFLVSAIgFiPz8xxv7jOKec7CudVIrIdfVPdixnh/Pb/Wj3knSgI="}]},"maintainers":[{"name":"stewartml","email":"stewartml@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/cognito-srp-0.1.0.tgz_1517784956595_0.1351114879362285"},"directories":{}},"0.2.0":{"name":"cognito-srp","version":"0.2.0","description":"Secure Remote Password protocol implementation compatible with Amazon Cognito.","main":"dist/lib/index.js","types":"dist/lib/index.d.ts","scripts":{"test":"jest --config=jest.config.json","prepublish":"tsc"},"author":{"name":"Stewart MacKenzie-Leigh"},"license":"ISC","devDependencies":{"@types/jest":"^22.1.1","@types/jsbn":"^1.2.29","jest":"^22.1.4","ts-jest":"^22.0.3","typescript":"^2.7.1"},"dependencies":{"jsbn":"^1.1.0"},"repository":{"type":"git","url":"git+https://github.com/stewartml/cognito-srp.git"},"keywords":["amazon","aws","cognito","srp","identity","auth"],"bugs":{"url":"https://github.com/stewartml/cognito-srp/issues"},"homepage":"https://github.com/stewartml/cognito-srp#readme","gitHead":"d0b58dd43a5312b621201c0421b0631289d449fd","_id":"cognito-srp@0.2.0","_npmVersion":"5.6.0","_nodeVersion":"8.9.0","_npmUser":{"name":"stewartml","email":"stewartml@gmail.com"},"dist":{"integrity":"sha512-zEaT6e/gxbA0NkxyrxRjDUBV+CkZqifjuk2n05VP2MIaZD2qTpGwss4jHw6Im4keF6gDP3bYeiPl5q6zD3kpBA==","shasum":"4333bda8a483eb866487a5462ec6eb226297e618","tarball":"https://registry.npmjs.org/cognito-srp/-/cognito-srp-0.2.0.tgz","fileCount":53,"unpackedSize":155461,"signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIDJ49g8/BLWr6ySYEsvCbjOEKX4sTJEjyihvg+W6uszHAiBewKq2YOURQJhtUI7tcvVqOLbmNuJ0kPv+amBHfF+oUQ=="}]},"maintainers":[{"name":"stewartml","email":"stewartml@gmail.com"}],"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/cognito-srp_0.2.0_1520439166276_0.2253177574664691"},"_hasShrinkwrap":false}},"readme":"# cognito-srp\n\nSecure Remote Password protocol implementation compatible with Amazon Cognito.\n\nThis package borrows heavily from the [srp-js](https://www.npmjs.com/package/srp-js) package, but implements a slight variant\nof the protocol in order to work with Amazon Cognito. Also inspired by bits from\n[amazon-cognito-identity-js](http://www.npmjs.com/package/amazon-cognito-identity-js), the official client library.\n\nUse it if you want to interact with Cognito without all the bloat of the AWS SDK, or if you want to write a server that acts\nlike Cognito, and is therefore compatible with the AWS SDK. Alternatively, use simply as a replacement for `srp-js`.\n\n## Usage\n\nFirst, install:\n\n```\nyarn add cognito-srp\n```\n\nThen import. Your starting point will usually be the `UserPool` class:\n\n```js\nimport { UserPool } from 'cognito-srp';\n```\n\nInstantiate a pool, using your pool name:\n\n```js\nconst userPool = new UserPool('7DZy4Fkn7');\n```\n\nNote that the pool name here is not the full `UserPoolId` that the AWS SDK asks for, i.e.:\n\n```js\nconst UserPoolId = 'us-east-2_7DZy4Fkn7';\nconst poolname = UserPoolId.split('_')[1];\n```\n\nThen the usage differs depending on whether you want to use it on the client or server.\n\n### On the server\n\nBefore you can check the identity of users, you need to create at least one:\n\n```js\nconst user = await userPool.createUser({username: 'testuser', password: 'pass123'});\n```\n\nThe `user` object contains the `username`, a `salt`, and a `verifier` value, a long string of hex\nwhich can be thought of as a password hash.\n\nWhen checking the identity of a user, the client will first make a request, passing\nthe username and a generated key called `A`.\n\nAssuming you can find the user from the username, you can then ask for a password challenge:\n\n```js\nconst challenge = await userPool.getServerChallenge(user);\n```\n\nFrom the challenge, you can get the server's generated key, called `B`, to pass back to the client.\n\n```js\nconst B = challenge.calculateB();\n```\n\nYou can also start a session, passing the client's key, `A`:\n\n```js\nconst session = challenge.getSession(A);\n```\n\nThe server sends `B` back to the client, along with their salt and a base64-encoded \"secret block\".\nI'm not completely sure what that block is for, perhaps session management.\n\nThen the client will make another request with a password signature, the secret block, and a timestamp.\nTo verify that they have the correct password, you must also calculate the signature and compare the two.\nIf they match, the client has the correct password.\n\n```js\nconst signature = session.calculateSignature(secretBlock, timestamp);\n\nif (signature === requestSignature) {\n  // yay\n}\n```\n\nIf you need to bin the session and rehydrate it later, for example, between the two requests, you can\nrecreate it from the \"HKDF\" value:\n\n```js\nconst hkdf = session.getHkdf();\n\n// ...\n\nconst newSession = new Session(poolname, username, hkdf);\n```\n\nNote that knowing the HKDF is as good as knowing the password for this session, so keep it safe\nif you're writing something important.\n\nIf you're writing a mock server to test something that uses cognito, you could send the HKDF\nout as the \"secret block\", as the client will echo it back to you on the next request, and\nit saves trying to store it.\n\n**This is obviously not a good idea in production.**\n\n### On the client\n\nOnce the user has entered their username and password, you can create a challenge:\n\n```js\nconst challenge = await userPool.getClientChallenge({username, password});\n```\n\nYou can then make a request to the server with the user's username and a client key (`A`):\n\n```js\nconst A = challenge.calculateA();\n```\n\nThe server will respond with the server key (`B`), the user's salt, and a secret block.\nThe client can then create a session:\n\n```js\nconst session = challenge.getSession(B, salt);\n```\n\nThen, the client can calculate the signature as proof that it knows the password:\n\n```js\nconst timestamp = getTimestamp();\nconst signature = session.calculateSignature(secretBlock, timestamp);\n```\n\nThe client sends the secret block, timestamp and signature back to the server, and its\nidentity is established.\n\n## Notes\n\nThe exact format of the requests and responses to Amazon Cognito is outside the scope of this package –\nit only implements the SRP stuff, and you can wrap it in whatever protocol you want.\n\nAlthough this library is compatible with Cognito and therefore successfully implements the Secure Remote Password\nprotocol, I'm not a security expert, and I don't claim to understand the maths behind it – keep that in\nmind before you use it for something important.\n","maintainers":[{"name":"stewartml","email":"stewartml@gmail.com"}],"time":{"modified":"2022-04-27T13:20:45.673Z","created":"2018-02-04T22:55:57.713Z","0.1.0":"2018-02-04T22:55:57.713Z","0.2.0":"2018-03-07T16:12:46.349Z"},"homepage":"https://github.com/stewartml/cognito-srp#readme","keywords":["amazon","aws","cognito","srp","identity","auth"],"repository":{"type":"git","url":"git+https://github.com/stewartml/cognito-srp.git"},"author":{"name":"Stewart MacKenzie-Leigh"},"bugs":{"url":"https://github.com/stewartml/cognito-srp/issues"},"license":"ISC","readmeFilename":"README.md"}