amazon-cognito - 如何使用 Amplify 在没有旧密码的情况下更新 Cognito 用户池中的用户密码？

Question

我们有多步注册表单，用户可以在步骤 2 中设置密码。（用户注册应该在步骤 1 本身进行）因此，我们将在步骤 1 中设置随机密码，并在 Cognito 用户池中注册用户详细信息。但最终用户从第 2 步提交实际密码。Cognito 不会在不发送旧密码（从第 1 步随机生成）的情况下更新密码（从第 2 步开始）。Cognito 认为这个过程将是密码更新。

那么我们需要如何处理这种情况呢？或者是否有任何放大提供的选项/技巧来克服这种情况？

标签： amazon-cognitoaws-amplify

Answer 1

More context is needed to fully understand why a random password is necessary for the user in this situation.

For example, if you are trying to create a multi-screen signup process and you don't want the user to get to the end of the process only to find out their password doesn't meet standards, e-mail already exists, etc., it may be more conducive to the user experience to check if the user already exists in the user pool first using ListUsers, collect the data as they move through the steps, and finally call the SignUp API call.

While I would highly recommend reconsidering the approach taken, the AdminSetUserPassword is a backend API call that can be used to set a permanent password for the user, although extreme care should be taken with this method to prevent the API call from being used maliciously on another user.