title: AWS Cognito hosted UI returning id_token in URL
body: <p>I am using AWS Cognito's hosted UI for user login. The id token is returned as part of the URL as described in <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-app-integration.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-app-integration.html</a>. Namely, </p>
  
  <blockquote>
    <p>You can find the JSON web token (JWT) identity token after the #idtoken= parameter in the response. Here's a sample response from an implicit grant request. <a href="https://www.example.com/#id_token=123456789tokens123456789&amp;expires_in=3600&amp;token_type=Bearer" rel="nofollow noreferrer">https://www.example.com/#id_token=123456789tokens123456789&amp;expires_in=3600&amp;token_type=Bearer</a></p>
  </blockquote>
  
  <p>However, putting sensitive data in a query string is considered a bad practice (<a href="https://stackoverflow.com/questions/323200/is-an-https-query-string-secure">Is an HTTPS query string secure?</a>). Does AWS Cognito support a more secure way of returning the id token? </p>