Sending message from Cognito triggers

Question

I want to restrict user sign-ins from Cognito hosted UI. I can see there are triggers in which we can attach lambda, but whenever I change event object inside of lambda, instead of getting my custom message User exceeded limits, I get unrecognizable lambda output error.

Can anyone help me in this or is there any other way to achieve this functionality?

Now,I'm getting this

with this code :

exports.handler = (event, context, callback) => {
    if (true) {
        var error = new Error("Cannot signin because your signin count is 5");
        // Return error to Amazon Cognito
        callback(error, event);
    }
    // Return to Amazon Cognito
    callback(null, event);
};

But,I don't want prefix PreAuthentication failed with error,I just want to display my message.

Any help is appreciated.

Answer 1

Currently, there is no way to stop Cognito from adding the prefix because the form is a hosted web UI.

If this is a hard requirement, the workaround is to create your own login form and use the aws-cognito-sdk

Once you make the call to cognitoUser.authenticateUser in the code below the Pre authentication trigger will fire the Lambda function and you will need to handle the error and parse it to remove the unwanted prefix.

Hope this Helps

aws Examples: Using the JavaScript SDK

var authenticationData = {
    Username : 'username',
    Password : 'password',
};
var authenticationDetails = new AmazonCognitoIdentity.AuthenticationDetails(authenticationData);
var poolData = { UserPoolId : 'us-east-1_TcoKGbf7n',
    ClientId : '4pe2usejqcdmhi0a25jp4b5sh3'
};
var userPool = new AmazonCognitoIdentity.CognitoUserPool(poolData);
var userData = {
    Username : 'username',
    Pool : userPool
};
var cognitoUser = new AmazonCognitoIdentity.CognitoUser(userData);
cognitoUser.authenticateUser(authenticationDetails, {
    onSuccess: function (result) {
        var accessToken = result.getAccessToken().getJwtToken();

        /* Use the idToken for Logins Map when Federating User Pools with identity pools or when passing through an Authorization Header to an API Gateway Authorizer*/
        var idToken = result.idToken.jwtToken;
    },

    //Your message from the Lambda will return here, you will need to parse the err to remove the unwanted prefix*
    onFailure: function(err) {

        alert(err);
    },

});