"Don't Roll Your Own Auth"
Building a secure login page from scratch is harder than it looks. You need to handle password hashing with a modern algorithm (bcrypt or Argon2), salt generation and storage, brute-force protection, account lockout policies, secure session management, TOTP-based MFA enrollment flows, SMS delivery for OTP codes, email verification workflows, and the full OAuth 2.0 Authorization Code Grant with PKCE. Each of these is a potential vulnerability if implemented incorrectly.
The Solution: Cognito Hosted UI
Cognito provides a pre-built, AWS-hosted authentication UI served from a domain you configure: https://<your-domain>.auth.<region>.amazoncognito.com. You configure it in the console, and you get a fully functional, secure login, sign-up, forgot-password, and MFA enrollment flow with zero application code.
What you get for free:
- Sign-up with email/phone verification
- Sign-in with username/password
- Forgot password with secure reset link
- MFA enrollment (TOTP via authenticator apps, SMS)
- "Sign in with Google / Facebook / Apple / SAML IdP" buttons
- CSRF protection and secure token handling via the Authorization Code Grant
The Authorization Code Grant flow (why it matters):
When a user logs in via the Hosted UI, Cognito does not return tokens directly to the browser URL (which would expose them in browser history and server logs). Instead, it returns a short-lived, single-use authorization code to your redirect URI. Your backend server exchanges this code for tokens via a server-to-server call. This keeps tokens out of the browser entirely.
Social and Enterprise Federation:
You can add identity providers in the Cognito console — Google, Facebook, Apple, or any SAML 2.0 / OIDC provider (like Okta, Azure AD, or a corporate ADFS). The Hosted UI automatically shows the configured provider buttons. From your application's perspective, the output is always the same: a Cognito JWT. You don't need to write provider-specific code.
Customization limits:
You can inject a custom logo and a custom CSS stylesheet. You cannot modify the underlying HTML structure or JavaScript. If you need pixel-perfect control over the UI, you must implement the OAuth flows yourself using the Cognito API (the InitiateAuth, RespondToAuthChallenge endpoints) and build your own UI on top.