But I have recently been thinking in the background about such things, so just did a quick search. This article does a reasonably good job of explaining how it works for Google. Specifically to your point, the Google form has homepage URLs and authorized JS origins. I am wondering whether your Cognito settings would have similar. The article also specifically shows how it retrieves the JWT from Google.

What I would love to see, inspired by some of the recent discussions on Mojolicious::Lite login examples, is a similar mockup to those using Mojolicious::Lite, but with specifically using one or more of the public OAuth servers for authentication. (And maybe one page that requires full login, and another page that shows different content depending on whether you are logged in or not.)

edit: add links to first steps with Mojolicious::Lite and RFC / Audit: Mojo Login Example /edit