Decode JWT From AWS Cognito Exposes poolId and Client app secret - amazon-web-services

Question

I have created an ASP .Net Core application that authenticates against Cognito.
My Authentication Controller looks like:
public class AuthenticationController : Controller
{
[HttpPost]
[Route("api/signin")]
public async Task<ActionResult<string>> SignIn(User user)
{
var cognito = new AmazonCognitoIdentityProviderClient(RegionEndpoint.APSoutheast2);
var request = new AdminInitiateAuthRequest
{
UserPoolId = "ap-southeast-2_mypoolid",
ClientId = "myclientid",
AuthFlow = AuthFlowType.ADMIN_USER_PASSWORD_AUTH
};
request.AuthParameters.Add("USERNAME", user.Username);
request.AuthParameters.Add("PASSWORD", user.Password);
var response = await cognito.AdminInitiateAuthAsync(request);
return Ok(response.AuthenticationResult);
}
}
Startup.ConfigureServices looks like:
services.AddAuthentication("Bearer")
.AddJwtBearer(options =>
{
options.Audience = "client key";
options.Authority = "https://cognito-idp.ap-southeast-2.amazonaws.com/ap-southeast-poolid";
});
I have included this in case it is something I have done in the above.
My Bearer tokens work fine. I auth against Cognito and get my access/id/refresh tokens.
Being new to Cognito and AWS in general and being curious, I ran my tokens at https://jwt.io/ and found that they contained my poolId and clientId. I was under the impression these are to be hidden away with the utmost security.
Is this normal or is it something I have done. I feel that maybe this shouldn't be exposed so easily?

Answer 1

Yes its normal, Only the secret should not be exposed.