Cognito user pool (with device tracking ON): Session refresh fails with error - "Invalid Refresh Token" #851
Comments
|
We are seeing this same issue, and we are able to reproduce it via POSTman by hitting the AWS api with POST@https://cognito-idp.us-east-1.amazonaws.com/ |
KaibaLopez
added
the
investigating
|
Hi @triton3 , |
KaibaLopez
added
the
response-requested
|
Greetings! It looks like this issue hasn’t been active in longer than a week. We encourage you to check if this is still an issue in the latest release. Because it has been longer than a week since the last update on this, and in the absence of more information, we will be closing this issue soon. If you find that this is still a problem, please feel free to provide a comment or add an upvote to prevent automatic closure, or if the issue is already closed, please feel free to open a new one. |
github-actions
bot
added
closing-soon
|
Yes the issue still persists @KaibaLopez |
|
I have this issue now. When I turn off the device tracking, It is working fine. My request {
"AuthParameters": {
"DEVICE_KEY": "{{deviceKey}}",
"REFRESH_TOKEN": "{{refreshToken}}"
},
"AuthFlow": "REFRESH_TOKEN_AUTH",
"ClientId": "{{clientId}}"
}Coming response {
"__type": "NotAuthorizedException",
"message": "Invalid Refresh Token."
} |
|
According to |
Issue
Using refresh token with Cognito user pool in an attempt to fetch new ID and access token fails, despite sending device key in the request. The user pool has device tracking enabled. The refresh token is still valid for another 30 days in this particular instance (it works when I switch OFF device tracking on the user pool).
What was attempted
I am trying to retrieve new ID and access tokens using cognito refresh token, through the
InitiateAuthAPI. The user pool on cognito has device tracking enabled. Based on this SO answer and this AWS forums discussion, I added theDEVICE_KEYparameter forREFRESH_TOKEN_AUTHauth flow. As per the documentation, I dont see any other requiredAuthParametersin the request.The initiate auth payload being sent out is as follows (refresh token is truncated, device key and client id are masked):
Result
NotAuthorizedException - Invalid Refresh TokenWhat else was attempted
When I disabled device tracking on the cognito user pool, the refresh token works fine and is able to retrieve new access/ID tokens.
What platform/OS are you using?
macOS High Sierra Version 10.13.4
What compiler are you using? what version?
Apple LLVM 9.0
Aws cpp sdk Version: 1.4.31
What's your CMake arguments?
Can you provide a TRACE level log? (sanitize any sensitive information)
The text was updated successfully, but these errors were encountered: