4

We have an app that uses AWS Cognito for authentication. The backend code (using AWS SDK for C# works fine mostly)

After the initial login, we obtain, ID, Access and Refresh TOKEN. Then every hour we try getting a new ID and ACCESS token by calling

  public bool ExtendTokens(string userRefreshToken, out AdminInitiateAuthResponse output)
  {
      output = null;
      AdminInitiateAuthRequest request = new AdminInitiateAuthRequest();
      AdminInitiateAuthResponse response = new AdminInitiateAuthResponse();
      try
      {
          request.UserPoolId = XXXXXXXXXXX;
          request.ClientId = YYYYYYYYYY;
          request.AuthFlow = AuthFlowType.REFRESH_TOKEN_AUTH;
          request.AuthParameters.Add("REFRESH_TOKEN", userRefreshToken);
          response = awsCognito_client.AdminInitiateAuth(request);

          if (response != null)
          {
              output = response;
              return true;
          }
      }
      catch (Exception ex)
      {
          //log the exception and the inner exception!
      }
      return false;
  }

on the backend side and passing them to the client. (The way this app works is that the client makes few calls every 3min to the server, and then server calls Cognito for authentication) then after 60min, renewing tokens the first time (60min after initial login) works fine! However, (after precisely 2hrs) the second time I get this error:

The remote server returned an error: (400) Bad Request.
Refresh Token has been revoked

For several internal/external users this happens right on the dot! 120min after they login using Username/Password. So it cannot be where a user signs out or we call GlobalSignOut accidentally. I have checked my code several places, I don't see where I might have goofed! I even use the same code module in another product and that one does not get kicked out at all! (That one does not make calls every now and then!)

Also, Tracking user devices is OFF. So it cannot be this answer. Moreover, the Cognito Limitation document does not say anything about the total number of calls per account!

Other useful details: the default expiry of our refresh token is 15days. That's why I call this two hours expiry prematurely! I am not able to reproduce this on my localhost, but it happens after deploying to IIS. I have checked the settings and the web.configs and I could not find any meaningful difference between the two that would invalidate my refresh tokens!

1 Answer 1

1

So, I was able to get around this (I still don't know the root cause) but the way to avoid this is to call the renew function every 45~50 minutes instead of waiting for that 1hr to pass! Doesn't make any sense but Its been 48hrs that my session is active and tokens are being renewed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.