RevokeToken behavior for multiple logins

[IgorPietraszko]

The Question

This is a general question regarding IAmazonCognitoIdentityProvider.RevokeTokenAsync() and related to #170. AWS documentation for Revoke Token (https://docs.aws.amazon.com/cognito/latest/developerguide/token-revocation.html) states that:

You can revoke a refresh token for a user using the AWS API. When you revoke a refresh token, all access tokens that were previously issued by that refresh token become invalid. The other refresh tokens issued to the user are not affected.

The question is, given the same User Pool and ClientId, would a login from 2 different browsers by the same user (same login credentials) receive the same access and refresh tokens and would RevokeTokenAsync() call invalidate both refresh tokens, another words, would both sessions' refresh tokens become invalid?

In case of JWT tokens, since they are self contained (as the article states further), would RevokeTokenAsync() have to be coupled with the issuance of a new JWT token that is expired?

Environment

• Build Version:
• OS Info:
• Build Environment:
• Targeted .NET Platform:

---

This is a ❓ general question

[ashishdhingra]

Hi @IgorPietraszko,

Good morning.

Thanks for posting question. To validate the behavior, following simple console application using [Amazon.Extensions.CognitoAuthentication] package version 2.2.2, could be leveraged (the code is only for demonstration purposes):

using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Amazon.CognitoIdentityProvider;
using Amazon.Extensions.CognitoAuthentication;
using Amazon.Runtime;

namespace CognitoTest
{
    class Program
    {
        private static string clientId = "7m3namtfok95oau1l1tqdgt2h8";
        private static string poolId = "us-east-2_HTm99yR1t";
        private static string userName = "testuser2";// [email protected]";
        private static string userPassword = "29@Sep@1979";

        static void Main(string[] args)
        {
            TestUserAuth().GetAwaiter().GetResult();
        }

        static async Task TestUserAuth()
        {
            var provider = new AmazonCognitoIdentityProviderClient(new AnonymousAWSCredentials(), FallbackRegionFactory.GetRegionEndpoint());
            var userPool = new CognitoUserPool(poolId, clientId, provider);
            var user = new CognitoUser(userName, clientId, userPool, provider);
            var response = (new AmazonCognitoIdentityProviderClient()).ListUsersAsync(new Amazon.CognitoIdentityProvider.Model.ListUsersRequest() { UserPoolId = poolId }).Result;
            AuthFlowResponse authResponse = await user.StartWithSrpAuthAsync(new InitiateSrpAuthRequest()
            {
                Password = userPassword    
            }).ConfigureAwait(false);

            while (authResponse.AuthenticationResult == null)
            {
                if (authResponse.ChallengeName == ChallengeNameType.NEW_PASSWORD_REQUIRED)
                {
                    Console.WriteLine("Enter your desired new password:");
                    string newPassword = Console.ReadLine();

                    authResponse = await user.RespondToNewPasswordRequiredAsync(new RespondToNewPasswordRequiredRequest()
                    {
                        SessionID = authResponse.SessionID,
                        NewPassword = newPassword
                    });
                }
                else if (authResponse.ChallengeName == ChallengeNameType.SMS_MFA)
                {
                    Console.WriteLine("Enter the MFA Code sent to your device:");
                    string mfaCode = Console.ReadLine();

                    AuthFlowResponse mfaResponse = await user.RespondToSmsMfaAuthAsync(new RespondToSmsMfaRequest()
                    {
                        SessionID = authResponse.SessionID,
                        MfaCode = mfaCode

                    }).ConfigureAwait(false);
                }
                else
                {
                    Console.WriteLine("Unrecognized authentication challenge.");
                    break;
                }
            }

            if (authResponse.AuthenticationResult != null)
            {
                Console.WriteLine("User successfully authenticated.");
                Console.WriteLine($"\nAccess Token: {authResponse.AuthenticationResult.AccessToken}\n\nID Token: {authResponse.AuthenticationResult.IdToken}\n\nRefresh Token: {authResponse.AuthenticationResult.RefreshToken}");
            }
            else
            {
                Console.WriteLine("Error in authentication process.");
            }

            Console.ReadLine();
        }

Publish the program to a folder and from 2 terminal/console windows, execute the same. It returns different sets of Access, ID and Refresh tokens.
Instance 1

User successfully authenticated.

Access Token: eyJraWQiOiI5Z0I4dzRUNFdrMWRMdThcL2U0THJsVGNJQVFJRTByMHIzbjdiSER4Rk1jdz0iLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJmNWUwNmM0OC00OTg0LTQwM2QtYjIwNi0zZDdhYmQyN2IzZ.....................bbTiy06OtGbb3rmZFhY_UyTnSQnsyhofIVbhd9HGozwnDijFvrzA

ID Token: <<removed>>

Refresh Token: eyJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAifQ.pyiLeyMT4OUGru20p5t5njrbi90Cx_7I_ijX9kpg4Wt4iPqnzJ3hQHx2LIAJ4k7hQDmLC5yzLRydX7FAVPdNA9tmRROwLDNzTr1huLT2n8o1tziRd1q7ARWxVqvfDyI2224k_iV54BtLNeoL4Varzfv2CwKCI0QvGgU1sH_4E-................U0xboYu9TYwrHWbSjqG5FnlefnrKMLdGwZvTYzn2DJtV8_p1Gt0ZlrO9RyM2eYtKjnNQ.MxLJIbLkSWC58iLOFYRcxA

Instance 2

User successfully authenticated.

Access Token: eyJraWQiOiI5Z0I4dzRUNFdrMWRMdThcL2U0THJsVGNJQVFJRTByMHIzbjdiSER4Rk1jdz0iLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJmNWUwNmM0OC00OTg0LTQwM2QtYjIwNi0zZD..............33LNmPCtOL4HGA58Z79EouUUyx51qMLApnBlXKORMwzN9tenBYlcEOSjPbu0ZUkKVUw

ID Token: <<removed>>

Refresh Token: eyJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAifQ.HUvnYWqdkUpfEdijY9Gaji63tF2zcvEob2EdgwAIRAeQdKEa8tSjnmAR-.....................-qlt5ig.YxiDfOAKnsGXO0SEgLBjhw

So to answer your question, login from 2 different browsers by the same user (same login credentials) would receive different sets of these tokens and RevokeToken API would only invalidate a particular refresh token.

If this answers your question, please mark my comment as the accepted answer.

Thanks,
Ashish

[IgorPietraszko]

Thank you Ashish for the example and for thoroughly answering the questions. So is there an API that would satisfy my need to sign the user out from "all sessions", i.e. revoke all tokens for this user/client id combination?

[ashishdhingra]

Per GlobalSignOut, it signs out users from all devices and also invalidates all refresh tokens issued to a user. However, the user's current access and ID tokens remain valid until their expiry. Access and Id tokens expire one hour after they're issued. I guess this would fit your scenario. In AWS SDK for .NET, it is exposed via AmazonCognitoIdentityProviderClient.GlobalSignOutAsync.

[IgorPietraszko]

Thanks.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.