Expired Token not getting refreshed about cloudfront-authorization-at-edge

[ottokruse]

Hi @thertzelle . How sure are you it is not your browser's cache?

[thertzelle]

If I visit the page in a new window, and visit the cookies tab, I have an old cookie. It seems like it would be hard to visit the page and it to not have requested the default endpoint and refresh the tokens?

[ottokruse]

If I visit the page in a new window, and visit the cookies tab, I have an old cookie.

Yeah, cookies are shared by all tabs. If the cookie is old in the new tab, it will be old in all tabs.

It seems like it would be hard to visit the page and it to not have requested the default endpoint and refresh the tokens?

Yeah, if a refresh token is there that is still valid, the solution of this repo would use it to refresh the tokens. (Which is intended behavior)

If the user clicks "sign-out" explicitly, the cookies are thrown away. If the user doesn't do that, but just closes the browser, the cookies might be thrown away but this depends on:

• If the cookiesettings you use in your Lambda@Edge-Auth setup include a max-age or expires, then the cookies will remain in your browser until that time

• If the cookiesettings you use in your Lambda@Edge-Auth setup do not include a max-age or expires, then the cookies are session cookies, that depending on your browser setup get deleted when you close the browser. Many browsers nowadays do not do that, it is a browser setting that users can alter.

Another factor coming into play, is that the refresh token itself has an expiry date, that can be set in the Cognito User Pool config (defaults to 30 days).

[ottokruse]

Closing for now, as I do not believe there is an action for this repo.

[yashsharma04]

Hi @ottokruse
Quick question: For scenarios, where we logout and we remove the cookies from the browser. But if we copy the id token before and use it to make further request from postman, it would still work.
What would be your recommendation to solve such use cases. (to invalidate the logged out id token since its stateless)

[ottokruse]

Best strategy I think is to have short token expiration so this risk becomes low enough to be acceptable.

Otherwise what you could do is call eg Cognito GetUser with the access token and if that fails you know the user is logged out. But it's not ideal to call that on every request (in checkauth lambda) because it adds latency and there is a max rps to it.

[yashsharma04]

Having a short token expiration is still flagged by our info-sec team. And making a n/w call as you mentioned adds latency. Any other approach that would be practical enough to implement? @ottokruse