A public single-page app for resident park reservations uses Amazon Cognito. How should the Cognito app client be configured for that SPA?
Select an answer to reveal the explanation.
Short Explanation
A browser is a glass fishbowl—anything you ship in JavaScript is public. Use auth code plus PKCE for the SPA and keep client secrets out of the bundle. Password-in-every-header and IAM keys in the browser are non-starters.
Full Explanation
Public clients such as SPAs cannot protect a client secret. Cognito app clients for SPAs should use authorization code with PKCE (or other public-client-appropriate flows) without embedding secrets in front-end code. Putting passwords or IAM access keys in the browser is insecure and outside proper Cognito client design.