New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

AdminDisableUser does not revoke tokens #381

Open

KristobalJunta opened this issue Apr 21, 2023 · 1 comment

KristobalJunta commented Apr 21, 2023 •

edited

Loading

There is an inconsistency in handling user tokens by cognito-local and "real" AWS Cognito.

InitiateAuth API call with USER_PASSWORD_AUTH flow returns tokens, namely: AccessToken, IdToken, RefreshToken.
If AdminDisableUser is called after that - user tokens are invalidated. As per documentation:

Deactivates a user and revokes all access tokens for the user.

If a new InitiateAuth is attempted after that with REFRESH_TOKEN_AUTH flow and a token saved from p1 - real AWS Cognito returns an error, due to the token being revoked.
On the other hand, cognito-local does not revoke tokens after p2 and the second InitiateAuth (p3) completes successfully.

kadyrleev commented Feb 7, 2024

Yep, userPasswordAuthFlow is currently missing a check for Enabled status.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment