AWS Cognito - 访问和刷新令牌

Question

I am currently switching from IBM APIC to AWS API Gateway. I found a different behaviour that it's not detailed in the AWS documentation ( https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.html )

After i use the refresh_token to get a new access_token i have a different behavior:

• In IBM the initial access_token is invalidated.
• In AWS you can call the API with the initial access_token and with the "new" access_token .

Is there an option to invalidate the initial access_token when the refresh_token is used?

Thanks.

Answer 1

So I think what you're seeing here is that old token is still valid, in short no you can't invalidate it UNLESS you call global sign out. I think the minimum time a token takes to expire 60 minutes.

Cognito has some flaws still really, listUsers API doesn't search by custom attributes, if you use federated identities you can't retrospectively link by email as you've found the token implementation isn't quite ideal yet.