New refresh token. about cloudfront-authorization-at-edge

[ottokruse]

Yeah you're right, maybe that is a better strategy!

[ottokruse]

Hi Gabriel. That is intended. The refresh token will remain the same.

The refresh token cannot be used to refresh itself. Thereby the expiry date of the refresh token is the ultimate date when the user has to sign in again.

[BartoGabriel]

Thanks Otto, so it is not a mistake, I did not interpret how it worked.

I usually refresh all tokens indefinitely as long as the user is active. When the user stops being active (does not access the web) is when the lifetime of the refresh token begins to run. For example, if someone is using github continuously, the session never expires, it expires when for an X time it is not used.

[ottokruse]

Don't hesitate to send a PR! (just saying 😄 )

[ottokruse]

Had a look into this and had to refresh my memory, found that Cognito indeed does not return a refresh token when refreshing tokens––Cognito only returns a new ID and Access token then.

Which makes total sense to me, the expiry date of the refresh token governs how long it is valid for (can set it to 10 years max).

So, closing this ticket as I believe there is no development opportunity for this solution here.