How to Add Passkeys to Amazon Cognito

docker-compose up

frontend-structure
.
├── src
|   ├── app
|   |   ├── auth
|   |   |   ├── auth.component.html       # HTML structure for login/sign-up view with email and password input
|   |   |   ├── auth.component.ts         # Interacts with AuthService to login and sign-up 
|   |   ├── ...
|   ├── logged-in
|   |   ├── logged-in.component.html      # HTML structure for logged-in view with main function to logout
|   |   ├── logged-in.component.ts        # Logout and go back to login/sign-up view
|   ├── app-routing.module.ts             # Routing
|   ├── app.component.html                # Display the page that is currently routed to
|   ├── auth.service.ts                   # Interaction with the backend to sign-up, login and logout
|   ├── ...
|   ├── assets
|   ├── index.html
|   ├── main.ts
|   ├── ... 
├── ...

npm install -g @angular/cli

ng serve

backend-structure
.
├── controllers
|   ├── authCognitoController.ts      # Controller that handles the communication with Amazon Cognito
├── app.ts                             # Our server that handles the routing to the controller
├── ...

npm install

npm run dev

defineCorbadoAuthChallenge.js
export const handler = async (event) => {
 
    // This if statement checks if the event object contains a session array property that is empty. If it is       
    // empty, it means that the authentication flow has just started, so the customChallenge function is 
    // called to send a custom challenge.
    if (!event.request.session.length) {
        return customChallenge(event);
    }
 
    // This if statement checks if any of the previous authentication attempts in the session array had a 
    // challengeName property that is not equal to "CUSTOM_CHALLENGE". If there was an attempt that 
    // used a different challenge type, the deny function is called with an error message.  
    if (
        event.request.session.find(
            (attempt) => attempt.challengeName !== "CUSTOM_CHALLENGE"
        )
    ) {
        return deny(event, "Expected CUSTOM_CHALLENGE");
    }
 
    // This code block handles the authentication response from the client. It checks the last item in the 
    // session array to see if the challengeResult property is true. If it is true, the authentication is 
    // considered successful, so the allow function is called to allow the user. If the challengeResult is not 
    // true, the function checks if the maximum number of failed attempts has been reached 
    // (determined by the countAttempts function). If the maximum number has not been reached, the 
    // customChallenge function is called to send another custom challenge. Otherwise, the deny function 
    // is called to deny the authentication request with an error message.
    const lastResponse = event.request.session.slice(-1)[0];
    if (lastResponse.challengeResult === true) {
        return allow(event);
    } else if (countAttempts(event, false) === 0) {
        return customChallenge(event);
    }
    return deny(event, "Failed to authenticate with passkeys");
};
 
// These are the helper functions used in the main handler function. deny is called to deny the 
// authentication request with an error message. Allow is called to allow the user if the authentication 
// is successful. customChallenge is called to send a custom challenge to the user.
function deny(event, reason) {
    event.response.issueTokens = false;
    event.response.failAuthentication = true;
    console.log("Authentication denied!")
    return event;
}
 
function allow(event) {
    event.response.issueTokens = true;
    event.response.failAuthentication = false;
    console.log("Authentication allowed!")
    return event;
}
 
function customChallenge(event) {
    event.response.issueTokens = false;
    event.response.failAuthentication = false;
    event.response.challengeName = "CUSTOM_CHALLENGE";
    return event;
}
 
// The countAttempts function returns the number of authentication attempts stored in the session array of the event
// object passed to the Lambda function. It optionally filters out any authentication attempts that used
// the PROVIDE_AUTH_PARAMETERS challenge type. This function is used in the handler function to determine if the
// maximum number of failed attempts has been reached, and if so, to deny the authentication request.
function countAttempts(
    event,
    excludeProvideAuthParameters = true
) {
    if (!excludeProvideAuthParameters) return event.request.session.length;
    return event.request.session.filter(
        (entry) => entry.challengeMetadata !== "PROVIDE_AUTH_PARAMETERS"
    ).length;
}

createCorbadoAuthChallenge.js
// This function generates a random challenge string and returns a response object containing the challenge string
// and other necessary parameters for the custom authentication flow to proceed.
export const handler = async (event) => {
    const challenge = Math.random().toString(36).substring(7);
 
    event.response = {
        challengeMetadata: 'CORBADO_CHALLENGE_COGNITO_CLAIM',
        // Cognito requires at least one public param
        publicChallengeParameters: {
            "challenge": challenge
        },
        privateChallengeParameters: {
            challenge: challenge
        }
    };
 
    return event;
};

verifyCorbadoAuthChallenge.js
export const handler = async (event) => {
 
    if (!event.request.privateChallengeParameters || event.request.privateChallengeParameters.challenge !== event.request.challengeAnswer) {
        event.response.answerCorrect = false;
        return event;
    }
 
    console.log("Successfully authenticated!")
    event.response.answerCorrect = true;
 
    return event;
}

index.html
<!doctype html>
<html lang="en">
<head>
</head>
<body>
  <script src="https://<Project ID>.frontendapi.corbado.io/auth.js"></script>
  <app-root></app-root>
</body>
</html>

auth.component.html
<corbado-auth project-id="<Project ID>" conditional="yes">
  <input name="username" id="corbado-username"
         required autocomplete="webauthn"/>
</corbado-auth>

app.module.ts
import {CUSTOM_ELEMENTS_SCHEMA, NgModule} from '@angular/core';
import { BrowserModule } from '@angular/platform-browser';
import { FormsModule } from '@angular/forms';
import {HttpClientModule} from "@angular/common/http";
import { AppRoutingModule } from './app-routing.module';
import { AppComponent } from './app.component';
import { AuthComponent } from './auth/auth.component';
import { LoggedInComponent } from './logged-in/logged-in.component';
 
@NgModule({
  declarations: [
    AppComponent,
    AuthComponent,
    LoggedInComponent
  ],
  imports: [
    BrowserModule,
    FormsModule,
    AppRoutingModule,
    HttpClientModule
  ],
  providers: [],
  bootstrap: [AppComponent],
  schemas: [CUSTOM_ELEMENTS_SCHEMA]
})
export class AppModule { }

auth.component.ts
import {Component, OnInit} from '@angular/core';
import {ActivatedRoute, Router} from '@angular/router';
import {AuthService} from '../auth.service';
import {Subscription} from 'rxjs';
 
@Component({
  selector: 'app-auth',
  templateUrl: './auth.component.html',
  styleUrls: ['./auth.component.scss']
})
export class AuthComponent implements OnInit {
 
  email = '';
  password = '';
  errorMessage = '';
  queryParamsSubscription!: Subscription;
 
  constructor(private authService: AuthService, private router: Router, private route: ActivatedRoute) {
    this.queryParamsSubscription = this.route.queryParams.subscribe((queryParams) => {
      if (queryParams['corbadoAuthToken'] != undefined) {
        let corbadoAuthToken = queryParams['corbadoAuthToken'];
        this.authService.corbadoAuthTokenValidate(corbadoAuthToken)
          .then(res => {
            router.navigate(['/logged-in'])
          })
          .catch(error => console.log(error));
      }
    })
  }
 
  ngOnInit(): void {
  }
 
// ...
 
}

auth.service.ts
import {Injectable} from '@angular/core';
import {HttpClient} from '@angular/common/http';
import {Router} from '@angular/router';
import {map, Observable, Subject} from 'rxjs';
 
@Injectable({
  providedIn: 'root'
})
export class AuthService {
 
  private isAuthenticated = false;
  private authStatusListener = new Subject<boolean>();
  private token: string = '';
  private userId: string = '';
 
  constructor(private http: HttpClient, private router: Router) {
  }
 
  getToken() {
    return this.token;
  }
 
  getUserId() {
    return this.userId;
  }
 
  getAuthStatusListener() {
    return this.authStatusListener.asObservable();
  }
    
// ...
 
  logout() {
    this.token = '';
    this.isAuthenticated = false;
    this.authStatusListener.next(false);
    this.router.navigate(['/login']);
  }
 
  getIsAuth() {
    return this.isAuthenticated;
  }
 
  async corbadoAuthTokenValidate(corbadoAuthToken: string) {
    try {
      this.http.get<{ idToken: string }>(`http://localhost:3000/api/corbado/authTokenValidate?corbadoAuthToken=${corbadoAuthToken}`)
        .subscribe(responseData => {
          const token = responseData.idToken;
          this.token = token;
          if (token) {
            this.isAuthenticated = true;
            this.authStatusListener.next(true);
            this.router.navigate(['/logged-in']);
          }
        });
    } catch (error) {
      console.error(error);
      throw error;
    }
  }
}

npm install corbado corbado-webhook --save

authCorbadoController.ts
import {Request, Response} from "express";
// @ts-ignore
import crypto from "crypto";
// @ts-ignore
import jwt from "jsonwebtoken";
import {verifyPassword, getUserStatus, createUser, createSession} from "./authCognitoController";
import {NOT_EXISTS} from "../utils/constants";
const Corbado = require('@corbado/node-sdk');
 
 
require("dotenv").config({ path: '../.env' });
 
 
// Corbado Node.js SDK
const CORBADO_PROJECT_ID = process.env.CORBADO_PROJECT_ID;
const CORBADO_API_SECRET = process.env.CORBADO_API_SECRET;
const config = new Corbado.Configuration(CORBADO_PROJECT_ID, CORBADO_API_SECRET);
const corbado = new Corbado.SDK(config);
 
 
export const handleWebhook = async (req: Request, res: Response) => {
    try {
        // Get the webhook action and act accordingly. Every Corbado
        // webhook has an action.
 
        let request: any;
        let response: any;
        console.log("BEFORE ACTION");
        switch (corbado.webhooks.getAction(req)) {
 
            // Handle the "authMethods" action which basically checks
            // if a user exists on your side/in your database.
            case corbado.webhooks.WEBHOOK_ACTION.AUTH_METHODS: {
                console.log("WEBHOOK AUTH METHODS");
                request = corbado.webhooks.getAuthMethodsRequest(req);
 
                // Now check if the given user/username exists in your
                // database and send status. Implement getUserStatus()
                // function below.#
                console.log("BEFORE USER STATUS");
 
                const status = await getUserStatus(request.data.username);
                let correctUserStatus = status.userStatus;
                if(status.createdByCorbado) {
                    correctUserStatus = "not_exists"
                }
                response = corbado.webhooks.getAuthMethodsResponse(correctUserStatus);
                res.json(response);
                break;
            }
 
            // Handle the "passwordVerify" action which basically checks
            // if the given username and password are valid.
            case corbado.webhooks.WEBHOOK_ACTION.PASSWORD_VERIFY: {
                console.log("WEBHOOK PASSWORD VERIFY");
                request = corbado.webhooks.getPasswordVerifyRequest(req);
 
                // Now check if the given username and password is
                // valid. Implement verifyPassword() function below.
                const isValid = await verifyPassword(request.data.username, request.data.password)
                response = corbado.webhooks.getPasswordVerifyResponse(isValid);
                res.json(response);
                break;
            }
            default: {
                res.status(400).send('Bad Request');
                return;
            }
        }
    } catch (error: any) {
 
        // We expose the full error message here. Usually you would
        // not do this (security!) but in this case Corbado is the
        // only consumer of your webhook. The error message gets
        // logged at Corbado and helps you and us debugging your
        // webhook.
        console.log(error);
 
        // If something went wrong just return HTTP status
        // code 500. For successful requests Corbado always
        // expects HTTP status code 200. Everything else
        // will be treated as error.
 
        res.status(500).send(error.message);
        return;
    }
}
 
export const authTokenValidate = async (req: Request, res: Response) => {
    console.log("AUTH TOKEN VALIDATE STARTED");
 
    try {
        let corbadoAuthToken = req.query["corbadoAuthToken"] as string;
        let clientInfo = corbado.utils.getClientInfo(req);
        let corbadoUser = await corbado.authTokens.validate(corbadoAuthToken, clientInfo);
        let username = JSON.parse(corbadoUser.data.userData).username;
        const status = await getUserStatus(username);
        console.log("USER EXISTS: ", status.userStatus);
 
        // if the user does not yet exist in AWS Cognito, add him in AWS Cognito
        if (status.userStatus === NOT_EXISTS) {
            console.log("CREATING USER...");
            await createUser(username);
        }
 
        // create an AWS Session
        console.log("GET AWS COGNITO SESSION TOKEN")
        let data = await createSession(username);
 
        res.json(data);
    } catch (error: any) {
        console.log(error);
        res.status(500).send(error.message)
    }
};

app.ts
// ...
 
// Old authentication process for Amazon Cognito
//app.post('/api/auth/signup', signUp);
//app.post('/api/auth/login', login);
app.post('/api/auth/logout', logout);
 
// Corbado passkey-first authentication
const projectID = process.env.CORBADO_PROJECT_ID;
const apiSecret = process.env.CORBADO_API_SECRET;
const corbadoWebhookUsername = process.env.CORBADO_WEBHOOK_USERNAME;
const corbadoWebhookPassword = process.env.CORBADO_WEBHOOK_PASSWORD;
 
const config = new Corbado.Configuration(projectID, apiSecret);
config.webhookUsername = corbadoWebhookUsername;
config.webhookPassword = corbadoWebhookPassword;
const corbado = new Corbado.SDK(config);
 
app.post('/api/corbado/webhook', corbado.webhooks.middleware, json(), handleWebhook);
app.get('/api/corbado/authTokenValidate', json(), authTokenValidate);
 
app.get('/ping', (req: Request, res: Response) => {
    res.send('pong');
});
 
 
const port = process.env.PORT || 3000;
 
app.listen(port, () => {
    console.log(`Server started on port ${port}`);
});

authCognitoController.ts
import {Request, Response} from "express";
import {
    AdminCreateUserCommand,
    AdminCreateUserCommandInput,
    AdminGetUserCommand,
    AdminGetUserCommandInput,
    AdminInitiateAuthCommand,
    AdminInitiateAuthCommandInput,
    AdminSetUserPasswordCommand,
    AdminSetUserPasswordCommandInput, AttributeType,
    AuthFlowType,
    ChallengeNameType,
    CognitoIdentityProviderClient,
    CognitoIdentityProviderClientConfig,
    GlobalSignOutCommand,
    InitiateAuthCommand,
    InitiateAuthCommandInput,
    InitiateAuthCommandOutput,
    MessageActionType,
    RespondToAuthChallengeCommand,
    RespondToAuthChallengeCommandInput,
    RespondToAuthChallengeCommandOutput,
} from "@aws-sdk/client-cognito-identity-provider";
// @ts-ignore
import crypto from "crypto";
// @ts-ignore
import {hashSecret, validateJWT, generatePassword} from '../utils/helper';
import {EXISTS, NOT_EXISTS} from "../utils/constants";
 
require("dotenv").config({ path: '../.env' });
 
 
const userPoolId = process.env.COGNITO_USER_POOL_ID;
const clientId = process.env.COGNITO_CLIENT_ID || "";
const clientSecret = process.env.COGNITO_CLIENT_SECRET || "";
const region = process.env.COGNITO_REGION || "";
const poolData = {UserPoolId: userPoolId, ClientId: clientId};
 
const clientConfig: CognitoIdentityProviderClientConfig = {
    region: region,
};
const client = new CognitoIdentityProviderClient(clientConfig);
 
// old Amazon Cognito code commented out
/*export const signUp = async (req: Request, res: Response) => {
    const {email, password} = req.body;
    // Workaround, as don't want to send out confirm emails
    const paramsAdminCreateUser: AdminCreateUserCommandInput = {
        ...poolData,
        Username: email,
        DesiredDeliveryMediums: ["EMAIL"],
        UserAttributes: [
            {Name: 'email', Value: email},
            {Name: 'email_verified', Value: 'true'},
        ],
        MessageAction: MessageActionType.SUPPRESS
    };
    try {
        const createUserCommand = new AdminCreateUserCommand(paramsAdminCreateUser);
        await client.send(createUserCommand);
        console.log("USER SUCCESSFULLY CREATED");
        const paramsSetUserPassword: AdminSetUserPasswordCommandInput = {
            ...poolData,
            Username: email,
            Permanent: true,
            Password: password
        };
        const confirmUserCommand = new AdminSetUserPasswordCommand(paramsSetUserPassword);
        await client.send(confirmUserCommand);
        console.log("USER SUCCESSFULLY CONFIRMED");
        res.status(200).json({message: 'User created successfully'});
    } catch (err) {
        console.log(err);
        res.status(500).json({message: 'An error occurred'});
    }
};
export const login = async (req: Request, res: Response) => {
    const {email, password} = req.body;
    const authParams = {
        ...poolData,
        AuthFlow: 'USER_PASSWORD_AUTH',
        AuthParameters: {
            USERNAME: email,
            PASSWORD: password,
            SECRET_HASH: ""
        },
    };
    const hash = hashSecret(clientSecret, email, clientId);
    if (hash && authParams.AuthParameters) {
        authParams.AuthParameters.SECRET_HASH = hash;
    }
    try {
        const initiateAuthCommand = new InitiateAuthCommand(authParams);
        const authResult = await client.send(initiateAuthCommand);
        if (!authResult.AuthenticationResult) {
            res.status(401).json({message: "Invalid credentials"});
            return;
        }
        res.status(200).json({token: authResult.AuthenticationResult.AccessToken});
    } catch (err) {
        console.log(err);
        res.status(401).json({message: 'Invalid credentials'});
    }
};*/
 
export const logout = async (req: Request, res: Response) => {
    const {token} = req.body;
    const params = {
        ...poolData,
        AccessToken: token,
    };
    try {
        const globalSignOutCommand = new GlobalSignOutCommand(params);
        await client.send(globalSignOutCommand);
        res.status(200).json({message: 'User logged out successfully'});
    } catch (err) {
        console.log(err);
        res.status(500).json({message: 'An error occurred'});
    }
};
 
 
export const verifyPassword = async (email: string, password: string): Promise<boolean> => {
 
    if (!(email?.trim() && password?.trim())) {
        console.log("Error with email or password");
        return false;
    }
    const params: InitiateAuthCommandInput = {
        ClientId: clientId,
        AuthFlow: AuthFlowType.USER_PASSWORD_AUTH,
        AuthParameters: {
            USERNAME: email,
            PASSWORD: password,
            SECRET_HASH: hashSecret(clientSecret, email, clientId) || ""
        },
    };
    try {
        const command = new InitiateAuthCommand(params);
        const output = (await client.send(command)) as InitiateAuthCommandOutput;
        return Boolean(output.AuthenticationResult);
    } catch (error) {
        console.log("Error authenticating user:", error);
        return false;
    }
}
 
interface UserAttributes {
    Name: string,
    Value: string
}
 
export const getUserStatus = async (email: string) => {
 
    const params: AdminGetUserCommandInput = {
        ...poolData,
        Username: email
    };
 
    try {
        const command = new AdminGetUserCommand(params);
        const response = await client.send(command);
 
        // We add a workaround for users, as users who have never been showed a password
        // exist in Cognito (with a random password). Therefore, we introduce the
        // custom variable "createdByCorbado" in the user pool which is stored on
        // every create user event caused by the Corbado web component.
 
        if (!response || !response.UserAttributes || !Array.isArray(response.UserAttributes)) {
            throw new Error('Invalid response object');
        }
 
        let createdByCorbado: boolean = false;
 
 
        response.UserAttributes.forEach((attr: AttributeType | undefined) => {
            if (attr && attr.Name === 'custom:createdByCorbado') {
                createdByCorbado = attr.Value === 'true';
            }
        });
 
        // if Corbado has created the user in AWS Cognito, we send back that the user
        // is not an existing user in the sense, he existed prior to Corbado
        return {
            userStatus: EXISTS,
            createdByCorbado: createdByCorbado
        };
    } catch (error: any) {
        if (error.name === 'UserNotFoundException') {
            return {
                userStatus: NOT_EXISTS,
                createdByCorbado: false
            };
        } else {
            throw error;
        }
    }
}
 
interface SessionInfo {
    email: string;
    cognitoUUID: string;
    name: string;
    expires: number;
    idToken: string;
    refreshToken: string;
}
 
 
export const createSession = async (username: string): Promise<SessionInfo> => {
 
    console.log("START CREATE SESSION")
    const params: AdminInitiateAuthCommandInput = {
        ...poolData,
        AuthFlow: AuthFlowType.CUSTOM_AUTH,
        ClientId: clientId,
        AuthParameters: {
            USERNAME: username,
            SECRET_HASH : hashSecret(clientSecret, username, clientId) || ""
        },
    };
 
    try {
        const adminInitiateAuthCommand = new AdminInitiateAuthCommand(params);
        const response = await client.send(adminInitiateAuthCommand);
 
        let answer = "FAILURE";
        if (response.ChallengeParameters) {
            answer = response.ChallengeParameters.challenge;
        }
 
        console.log("ANSWER:", answer)
        const respondToAuthChallengeCommand: RespondToAuthChallengeCommandInput = {
            ClientId: clientId,
            ChallengeName: ChallengeNameType.CUSTOM_CHALLENGE,
            ChallengeResponses: {
                ANSWER: answer,
                USERNAME: username,
                SECRET_HASH : hashSecret(clientSecret, username, clientId) || ""
 
            },
            Session: response.Session
        };
 
        const AuthChallengeCommand = new RespondToAuthChallengeCommand(respondToAuthChallengeCommand);
        const authResult = await client.send(AuthChallengeCommand) as RespondToAuthChallengeCommandOutput;
 
        if (authResult?.AuthenticationResult) {
            const token = await validateJWT(
                authResult.AuthenticationResult.IdToken as string
            )
            const user: any = token as any;
 
            return {
                email: user.email as string,
                cognitoUUID: user.sub,
                name: user.name,
                expires: user.exp,
                idToken: authResult.AuthenticationResult.IdToken as string,
                refreshToken: authResult.AuthenticationResult.RefreshToken as string,
            };
        } else throw Error("Failed to create session");
    } catch (error) {
        throw error;
    }
}
 
 
export const createUser = async (email: string) => {
    const params: AdminCreateUserCommandInput = {
        ...poolData,
        Username: email,
        DesiredDeliveryMediums: ["EMAIL"],
        UserAttributes: [
            {Name: 'email', Value: email},
            {Name: 'email_verified', Value: 'true'},
            {Name: 'custom:createdByCorbado', Value: 'true'}
        ],
        MessageAction: MessageActionType.SUPPRESS
    };
    try {
        const createUserCommand = new AdminCreateUserCommand(params);
        const responseCreateUserCommand = await client.send(createUserCommand);
 
        console.log("USER SUCCESSFULLY CREATED");
 
        const setPasswordParams: AdminSetUserPasswordCommandInput = {
            ...poolData,
            Username: email,
            Permanent: true,
            Password: generatePassword(15)
        };
        const confirmUserCommand = new AdminSetUserPasswordCommand(setPasswordParams);
        await client.send(confirmUserCommand);
        console.log("USER SUCCESSFULLY CONFIRMED");
 
        return responseCreateUserCommand;
    } catch (error: any) {
        console.log("Error during user creation: ", error);
        return false;
    }
}

constants.ts
export const EXISTS = 'exists';
export const NOT_EXISTS = 'not_exists';
export const BLOCKED = 'blocked';

helper.ts
// @ts-ignore
import crypto from "crypto";
// @ts-ignore
import jwt from "jsonwebtoken";
import {int} from "aws-sdk/clients/datapipeline";
// @ts-ignore
import jwkToPem, {JWK} from "jwk-to-pem";
 
require("dotenv").config({ path: '../.env' });
 
const clientId = process.env.COGNITO_CLIENT_ID;
const region = process.env.COGNITO_REGION;
const envJWKS = process.env.COGNITO_JWKS;
const userPoolId = process.env.COGNITO_USER_POOL_ID;
const jwks: JWK[] | any[] = JSON.parse(envJWKS as string);
 
export function hashSecret(clientSecret: string, username: string, clientId: string) {
    if (!clientSecret) {
        return null;
    }
    return crypto
        .createHmac("SHA256", clientSecret)
        .update(username + clientId)
        .digest("base64");
}
 
export function validateJWT(jwtToken: string, skipExpiredCheck?: boolean) {
    let res;
    try {
        let pem = jwkToPem(jwks[0]);
        res = jwt.verify(jwtToken, pem, {algorithms: jwks[0].alg});
    } catch (error) {
        let pem = jwkToPem(jwks[1]);
        res = jwt.verify(jwtToken, pem, {algorithms: jwks[1].alg});
    }
 
    if (!jwtToken.trim()) {
        console.log("Error with JWT");
        return;
    }
    let decoded = jwt.decode(jwtToken);
    const now = +new Date() / 1000;
    // @ts-ignore
    if (!skipExpiredCheck && decoded.exp < now) {
        console.log("Token expired");
        return;
    }
    // @ts-ignore
    if (decoded.aud !== clientId) {
        console.log("Invalid audience in token");
        return;
    }
    // @ts-ignore
    if (decoded.iss !== `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`) {
        console.log("Invalid iss in token");
        return;
    }
    return res;
}
 
export function generatePassword(length: int) {
    const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+~`|}{[]:;?><,./-=";
    let password = "";
    for (let i = 0; i < length; i++) {
        const randomIndex = Math.floor(Math.random() * charset.length);
        password += charset[randomIndex];
    }
    return password;
};

corbado subscribe http://localhost:3000