在 AWS Cloudfront 中创建一个新的行为,将该行为设置为允许所有的 HTTP 方法,然后将 Cookie 设置为“*”,然后将该行为与 AWS Cognito 连接。此外,在 AWS Cognito 中,确保“授权范围”中包含您允许用户从 Cloudfront 访问的资源。
以下是一个示例 Node.js 代码,用于设置 AWS Cloudfront 行为:
const AWS = require('aws-sdk');
const cloudfront = new AWS.CloudFront();
// 创建一个新的 Origin,连接到我们的 Cognito 用户池
const userPoolId = 'YOUR_USER_POOL_ID';
const cognitoOrigin = {
Id: `cognito-${userPoolId}`,
DomainName: `${userPoolId}.auth.us-east-1.amazoncognito.com`,
CustomHeaders: {
'host': [{
Key: 'host',
Value: `${userPoolId}.auth.us-east-1.amazoncognito.com`
}]
},
OriginPath: '/oauth2',
OriginProtocolPolicy: 'https-only',
CustomOriginConfig: {
HTTPPort: 443,
HTTPSPort: 443,
OriginSslProtocols: {
Items: ['TLSv1.2'],
Quantity: 1
},
OriginReadTimeout: 30,
OriginKeepaliveTimeout: 5
}
};
// 创建新的 Cloudfront 行为,将其设置为允许所有 HTTP 方法
const createBehavior = cloudfront.createDistribution.bind(cloudfront);
const newBehaviorParams = {
DistributionId: 'YOUR_DISTRIBUTION_ID',
IfMatch: 'ETAG_VALUE',
DefaultCacheBehavior: {
AllowedMethods: {
Items: ['HEAD', 'GET', 'OPTIONS', 'PUT', 'POST', 'PATCH', 'DELETE'],
Quantity: 7,
CachedMethods: {
Items: ['HEAD', 'GET', 'OPTIONS'],
Quantity: 3
}
},
CachedMethods: {
Items: ['HEAD', 'GET', 'OPTIONS'],
Quantity: 3
},
TargetOriginId: 'THE_ID_OF_YOUR_ORIGIN',
ForwardedValues: {
QueryString: true,
Cookies: {
Forward: 'all',
WhitelistedNames: {
Quantity: 0
}
},
Headers: {
Quantity: 0
},
QueryStringCacheKeys: {
Quantity: 0
}
},
MinTTL: 60,
ViewerProtocolPolicy: 'redirect-to-https',
Compress: true,
SmoothStreaming: false,
DefaultTTL: 86400,
MaxTTL: 31536000,
LambdaFunctionAssociations: {
Quantity: 0
},
FieldLevelEncryptionId: '',
TrustedSigners: {
Enabled: false,
Quantity: 0
}
},
CacheBehaviors: {
Quantity: 0
}
};
createBehavior(newBehaviorParams, (err, data) => {
if (err) {
console.error(err, err.stack);
} else {
console.log(data);
}
});