I'm building a mobile app for users to upload their blood reports, which an AI model analyzes to provide personalized health guidance. My tech stack includes React Native and Expo for the frontend, Spring Boot with PostgreSQL for the backend, and various AWS services like Amplify and S3 for cloud storage. I'm currently at the stage of deciding how to handle user authentication securely.
I have two options in mind: 1) Utilize AWS Amplify (Cognito) for handling user sign-ups, logins, password resets, MFA, and token management, with Spring Boot just validating JWT tokens from Cognito. This seems simple and avoids the hassle of building an auth system from scratch.
2) Develop my own authentication entirely within Spring Boot, managing JWT generation, password storage, and so on, giving me complete control over the process.
Given that this app deals with sensitive medical data, I'm particularly concerned about avoiding security lapses while keeping development manageable. I'm leaning toward using Amplify Auth to let Cognito handle identity management and just use Spring Boot as a resource server for token validation. Before making a final decision, I'd like to know if this approach is effective for secure mobile app access on AWS and if there are any known issues with validating Cognito tokens in Spring Boot. Would you advise going with Amplify Auth or should I build my own? Any insights from those who've worked on similar projects would be greatly appreciated!
2 Answers
I agree with the points about Cognito. It’s a cost-effective solution for auth, true, but if you're looking for scalability and control, you might not want to rely on it. Amplify can be a good initial tool, especially if you're using AWS services, but I’d recommend keeping an eye on what version you use—Amplify Gen 2 has some nice extensions available through CDK, while Gen 1 had quite a few limitations.
Exactly, and don’t overlook the importance of choosing the right database early on as well!
Cognito does have some limitations, like not being able to back it up or restore it, and multi-region support can be a hassle. It's best used as a federated identity provider, so I wouldn’t recommend relying on it for your core user data. Maybe consider other options like Auth0 or Okta until your app scales.
For user management, I suggest skipping Amplify altogether and using a paid service for more control, like Auth0, and implementing JWT validation at your API Gateway with a Lambda authorizer. This way you can separate the authentication concerns from your application. Also, starting with Spring Cloud Functions on AWS Lambda can simplify things for you and allow for easier scaling in the future.
Thanks for the helpful insight!
+1 on that advice! If you have a solid team, definitely consider DynamoDB for data storage—it could streamline your app significantly!
Definitely keep up with the updates from AWS—things change fast!