Diagnostic Test – Incorrect answer

[Viktor Krasheninnikov]

Question: What solution the security engineer must implement to prevent exposure of the source code to unauthenticated users while ensuring that authenticated users can continue to use the application as intended?

Accepted answer: Deploy an Amazon Cognito hosted user interface (UI) for the login. Integrate Lambda@Edge logic into the CloudFront distribution to decide between serving content or redirecting to the login.

According to AWS: https://aws.amazon.com/blogs/aws/introducing-cloudfront-functions-run-your-code-at-the-edge-with-low-latency-at-any-scale/#:~:text=URL%20rewrites%20and%20redirects%3A%20Generate%20a%20response%20to%20redirect%20requests%20to%20a%20different%20URL.%20For%20example%2C%20redirect%20a%20non%2Dauthenticated%20user%20from%20a%20restricted%20page%20to%20a%20login%20form.%20URL%20rewrites%20can%20also%20be%20used%20for%20A/B%20testing.

The answer should be: Deploy an Amazon Cognito hosted user interface (UI) for the login. Integrate CloudFront Functions logic into the CloudFront distribution to decide between serving content or redirecting to the login.

[Neil-TutorialsDojo]

Hi Viktor Krasheninnikov,

Good day! Thank you for your feedback.

Referring from the explanation given: “Although adding logic to serve content or redirect the user to login can prevent unauthenticated users from accessing the index.html, the CloudFront functions feature remains inadequate because it cannot utilize certain libraries. To satisfy the requirement for this solution, you must use libraries to validate the JWTs, which is outside the capability of CloudFront functions. Keep in mind that CloudFront functions serve a similar purpose as the Lambda@edge function, a middleware service that allows developers to run code; however, it is only ideal for short and simple tasks.“

Thus the Accepted answer: “Deploy an Amazon Cognito hosted user interface (UI) for the login. Integrate Lambda@Edge logic into the CloudFront distribution to decide between serving content or redirecting to the login.”

I hope this helps.

Regards,
Neil @ Tutorials Dojo