Custom authorizer vs Cognito - authentication for amazon api gateway - Web application
<p>I have been making a web app. (Angular 2 on S3 and APIs in lambda through API gateway). For authentication I played both with cognito and custom authorizer (I configured my authentication to work with Google and Facebook bith via a custom authorizer and cognito). In case of custom authorizer I am passing a token via authroization header and my custom authorizer validates it. </p>

<p>I am looking for advice on which should I go forward with and what are their pros and cons. Ones that I could think of are:</p>

<p>AWS cognito:</p>

<p>Pros</p>

<ol>
<li>AWS SDK handles everything for you and you cannot make much mistake in your authentication process.</li>
<li>Fine grained access control for AWS resources via IAM.</li>
<li>An extra lambda function in front of every API is not required for authentication.</li>
</ol>

<p>Cons</p>

<ol>
<li>Need to use AWS SDK specifically on client side. Programmers have to add this into their toolchain and make use if it during development. Adds extra complexity.</li>
<li>Fine grained access control for resources is not really required since the only access that is required is for API gateway.</li>
</ol>

<p>Custom authorizer</p>

<p>Pros</p>

<ol>
<li>You can have your authentication mechanism the way you want it. Ultimate control over authentication and authorization.</li>
<li>You can have the UI call the APIs with a standard token (JWT) and the flow for developers remains same. No extra consideration of AWS SDK.</li>
</ol>

<p>Cons</p>

<ol>
<li>Authentication requires a lot of thinking and effort to build.</li>
<li>Chances of missing some crucial aspects are always there.</li>
<li>Its like reinventing the wheel. Why do it when Amazon has already done it for you.</li>
</ol>

<p>All that being said, I am leaning towards custom authorizer for now. Need advice here on the topic.</p>

<p>PS: I know there cannot be a definite answer to the question I have posted but it would be of great help to people trying to decide on authentication for their applications.</p>