Question: I am integrating JWT authorization from Cognito into my Nestjs application and I am running into a sort of a chicken vs egg situation.

If a generate clientSecret for my Cognito client, I will get the following error:

> 
> "Unable to verify secret hash for client {Client\_Id}"
> 
> 
> 

If I uncheck clientScret generation when creating a new client in Cognito, I will get the following error when the application compiles:

> 
> [ExceptionHandler] JwtStrategy requires a secret or key +0ms
> 
> 
> 

I have been following this guide to implement it: <https://brightinventions.pl/blog/using-cognito-with-nest-js/>, but it does not really address any of these issues.

Could someone provide some guidance here?

Answer: 
The tutorial you shared let the back-end side handle the user register, sign in, and sign out. I want to delegate the access token getting to AWS Cognito.

For a user to request protected resources, the backend side validates the access token passed as a bearer token in two ways:

* Use middleware: <https://github.com/katesroad/Cognito-as-Authentication-Provider-for-NestJs/blob/main/backend/src/common/middlewares/auth.middleware.ts>

Also, this link worth reading <https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-verifying-a-jwt.html>.

How to validate the jwt token generated by an AWS Cognito pool.

If you don't want to access other user information, having the user being validate is enough by validating the user's access token.

If you want to get the user's other information (such as email and custom attributes), you can use the version shared by you or getting user information by the user's sub id stored in the JWT token.

Thanks, happy coding. Hope this could help you.
```
import { ExtractJwt, Strategy } from 'passport-jwt';
import { PassportStrategy } from '@nestjs/passport';
import { Injectable, Logger, UnauthorizedException } from '@nestjs/common';
import { passportJwtSecret } from 'jwks-rsa';

@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
  constructor() {
    super({
      secretOrKeyProvider: passportJwtSecret({
        cache: true,
        rateLimit: true,
        jwksRequestsPerMinute: 5,
        jwksUri: https://cognito-idp.{region}.amazonaws.com/{userPoolId}/.well-known/jwks.json
      }),

      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      audience: 'client id',
      issuer: https://cognito-idp.<region>.amazonaws.com/<userpoolID>.
      algorithms: ['RS256'],

    });
  }

  async validate(payload: any) {
    console.debug('JWT VALIDATION')
    return !!payload.sub;
  }
}

```