Setting preferred_username attribute on unconfirmed account during signup problem

** Which Category is your question related to? ** Authentication/Sign Up

** What AWS Services are you utilizing? ** Cognito

** Provide additional details e.g. code snippets ** We are using AWS Amplify v1.0.8, and the Amplify.Auth.signUp API call in particular.

When we try to sign up a user with the user attribute, preferred_username, set to “firstName.lastName”, we get an error back,

“Preferred username cannot be provided for unconfirmed account, since user pool is configured for preferred username alias.”

Why does this restriction exist? We generate UUIDs for the Cognito username, thus we also want to set a preferred username, so that the user can login using the preferred username, which is more user-friendly than a UUID.

I can’t think of a reason why the preferred username needs to be confirmed, or why it can only be set after the account has been confirmed.

Please advise.

Here’s the relevant snippet of the code, though I don’t think it’s related:

    const preferredUsername = await getUniquePreferredUsername( registrationInfo );

    return Amplify.Auth.signUp( {
      username: uuidv4(),
      password: registrationInfo.password,
      attributes: {
        preferred_username: preferredUsername,
        email: registrationInfo.email,
        'custom:createMethod': registrationInfo.createMethod || 'signup',
        'custom:userType': registrationInfo.userType || 'Teacher',
      },
    } )

[tcchau]

Sorry I didn’t have a chance to follow up on this issue. I actually got a response back from AWS Support, although I don’t think the community necessarily needs to be satisfied with this answer. They said that you can’t do what I want to do, because it’s a security risk to allow setting the preferred_username before the account is confirmed, though it isn’t a security risk to be able to set the email address in the same way. When I asked them to explain, they cite security concerns as to why they could not disclose:

1. Can you please explain the specific security risks with disallowing the preferred_username to be set at sign up? We’d like to learn about these issues. Unfortunately due to security reasons, we are unable to expose the potential security risks relating to disallowing the preferred_username during signup. We truly apologise for any inconvenience this may cause and sincerely appreciate your understanding on this.

2. Also why is the the preferred_username treated differently from the email address? Our User Pool is configured to allow both preferred_username and email address as aliases for sign in purposes, however, the email address can be set before the account is confirmed.

   When the email address is set during signup, the email address has the email_verified attribute. When the email is is verified, the attribute email_verified becomes true, and the alias is now active. However, preferred_username does not have an attribute preferred_username_verified to help identify if this preferred_username is set for a verified user. Hence the only way for this to happen is to ensure that the preferred_username is only set after the user is confirmed.

For us, we have elected to work around this problem by setting the preferred_username after the user has confirmed their account. We use Custom Message trigger to send an email to the user to confirm, so they don’t have to type in a UUID.

It is one of, perhaps 30 or so, workarounds we’ve had to pepper our codebase with, to work around problems we didn’t foresee would exist in AWS Cognito/Amplify. Unfortunate but true. Fortunately, we actually use Cognito only for username+password authentication, and store the user’s profile separate in a traditional database, so if we really have to, we could move to a different authentication service. It would just be an expensive project and, in my mind, unnecessary if AWS Cognito were more mature as a product.

[github-actions[bot]]

This issue has been automatically locked since there hasn’t been any recent activity after it was closed. Please open a new issue for related bugs.

Looking for a help forum? We recommend joining the Amplify Community Discord server *-help channels or Discussions for those types of questions.