title: How to use AWS Cognito for unauthenticated users?
body: <p>I'd like to use AWS Cognito (User Pools and Identity Pools) for managing access to my web app.</p>
  
  <p>This web app is a report generator. It generates reports from gathered sensors' data.</p>
  
  <p>The possible scope of requested data should vary between users. Some users should only have access to specific sensor IDs or sensors from a specified area or date range.</p>
  
  <p>However, I'd like to make some reports publicly available - eg. data from sensors from New York should be available to everyone without the need to sign up/sign in.</p>
  
  <p>As for authenticated users, I think I could just add a custom attribute to Cognito User Pool with sensor IDs that the specified user should have access to.
  Then, after signing up and logging in with Cognito, the user could make a request to my application and I would verify the JWT and get from the payload information about what sensors can the user request.</p>
  
  <p>Unfortunately, I'm not sure how to handle unauthenticated users. I see it like that:</p>
  
  <ol>
  <li>The user navigates to a page with a specific public report. Eg. <a href="https://example.com/reports/new-york/" rel="nofollow noreferrer">https://example.com/reports/new-york/</a></li>
  <li>Frontend (React.js) somehow gets signed JWT with custom attribute <code>custom:city</code> = <code>New York</code>.</li>
  <li>Frontend makes a request to my application, my app verifies JWT and permits the data to the user if the request contains a query only for New York's sensors.</li>
  </ol>
  
  <p>Maybe I should create a user with known username and password and hardcode it in the frontend?</p>
  
  <p>Is it a proper way to use Cognito? Should I implement it in some other way?</p>