User Pool allows two users with same email despite configuration

Question

Background

I'm using aws-amplify to interact with Cognito. So when a user registers with my app, I call Auth.signUp(). I'm passing only username (email) and password to this function.

My user pool is configured to allow sign in by email only:

---

The Bug?

In my front end code, I accidentally registered an event listener twice, so Auth.signUp() was being called twice (concurrently, or at least in rapid succession) with the same parameters.

This resulted in two users being created in my User Pool, with the same email. My understanding of my user pool configuration suggests that this shouldn't be possible.

---

Race Condition?

My first thought was that since I'm sending two requests so close together, this may be some sort of unavoidable race condition. If I introduce an artificial pause between the calls (a breakpoint, or a setTimeout, say), everything works as expected.

However, even with the requests very tightly spaced, the second request does return the error response I'd expect:

{ code: 'InvalidParameterException',
  name: 'InvalidParameterException',
  message: 'Alias entry already exists for a different username' 
}

Sadly, this response is misleading, because I do get a second (duplicate) user created in my pool with this request.

---

MCVE

This is easy to reproduce by exercising Auth.signUp twice concurrently, either in a node script or a browser. This repository contains examples of both.

---

The Question(s)

• Is this a legitimate bug with Cognito?
• Is a preSignUp Lambda trigger my only way to defend against this? If so, what would the broad strokes of that implementation look like?

Answer 1

I sent this to AWS support. They're aware of the issue but have no ETA.

Thanks for contacting AWS Premium Support. I understand that you would like to know whether Cognito team is aware of the issue posted here[1].

I checked with Cognito team on our end and YES, they are aware of this issue/bug. Good news is, we already have trouble ticket open with Cognito Team to fix the issue. However, I won't be able to provide an ETA on when this fix will go live as I don't have any visibility into their development/release plans. But, I would like to thank you for your valued contribution in bringing this issue to our attention, I do appreciate it.