Skip to content

feat(auth): Refresh Token Rotation #3112

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Aug 26, 2025
Merged

feat(auth): Refresh Token Rotation #3112

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
d8bdd32
updated refresh token action to use GetTokensFromRefreshToken API ins…
ekjotmultani Aug 18, 2025
9adfe5b
added unit tests and GetTokensFromRefreshToken to cognito mock factories
ekjotmultani Aug 18, 2025
cf2a9a9
updated generated json for tests to use new API
ekjotmultani Aug 18, 2025
97ef445
fixed typo in GetTokensFromRefreshToken (no 's' at the end)
ekjotmultani Aug 18, 2025
739ef8b
added test cases for device key included and not, as well as a null r…
ekjotmultani Aug 19, 2025
855c746
updated smithy version to match kotlin sdk bump
ekjotmultani Aug 19, 2025
24cfc12
added comment clarifying refresh token logic
ekjotmultani Aug 19, 2025
f69fbde
ktlint formatting conformity
ekjotmultani Aug 19, 2025
1dbde13
Merge branch 'main' into ekjotmultani/refresh-token-rotation
mattcreaser Aug 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 6 additions & 25 deletions ...src/main/java/com/amplifyframework/auth/cognito/actions/FetchAuthSessionCognitoActions.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,11 +17,9 @@ package com.amplifyframework.auth.cognito.actions

import aws.sdk.kotlin.services.cognitoidentity.model.GetCredentialsForIdentityRequest
import aws.sdk.kotlin.services.cognitoidentity.model.GetIdRequest
import aws.sdk.kotlin.services.cognitoidentityprovider.initiateAuth
import aws.sdk.kotlin.services.cognitoidentityprovider.model.AuthFlowType
import aws.sdk.kotlin.services.cognitoidentityprovider.getTokensFromRefreshToken
import aws.smithy.kotlin.runtime.time.Instant
import com.amplifyframework.auth.cognito.AuthEnvironment
import com.amplifyframework.auth.cognito.helpers.AuthHelper
import com.amplifyframework.auth.cognito.helpers.SessionHelper
import com.amplifyframework.auth.exceptions.NotAuthorizedException
import com.amplifyframework.auth.exceptions.SessionExpiredException
Expand All @@ -40,44 +38,27 @@ import com.amplifyframework.statemachine.codegen.events.RefreshSessionEvent
import kotlin.time.Duration.Companion.seconds

internal object FetchAuthSessionCognitoActions : FetchAuthSessionActions {
private const val KEY_SECRET_HASH = "SECRET_HASH"
private const val KEY_REFRESH_TOKEN = "REFRESH_TOKEN"
private const val KEY_DEVICE_KEY = "DEVICE_KEY"

override fun refreshUserPoolTokensAction(signedInData: SignedInData) =
Action<AuthEnvironment>("RefreshUserPoolTokens") { id, dispatcher ->
logger.verbose("$id Starting execution")
val evt = try {
val username = signedInData.username
val tokens = signedInData.cognitoUserPoolTokens

val authParameters = mutableMapOf<String, String>()
val secretHash = AuthHelper.getSecretHash(
username,
configuration.userPool?.appClient,
configuration.userPool?.appClientSecret
)
tokens.refreshToken?.let { authParameters[KEY_REFRESH_TOKEN] = it }
secretHash?.let { authParameters[KEY_SECRET_HASH] = it }

val encodedContextData = getUserContextData(username)
val deviceMetadata: DeviceMetadata.Metadata? = getDeviceMetadata(username)
deviceMetadata?.let { authParameters[KEY_DEVICE_KEY] = it.deviceKey }
val pinpointEndpointId = getPinpointEndpointId()

val response = cognitoAuthService.cognitoIdentityProviderClient?.initiateAuth {
authFlow = AuthFlowType.RefreshToken
val response = cognitoAuthService.cognitoIdentityProviderClient?.getTokensFromRefreshToken {
refreshToken = tokens.refreshToken
clientId = configuration.userPool?.appClient
this.authParameters = authParameters
pinpointEndpointId?.let { analyticsMetadata { analyticsEndpointId = it } }
encodedContextData?.let { userContextData { encodedData = it } }
clientSecret = configuration.userPool?.appClientSecret
deviceKey = deviceMetadata?.deviceKey
}

val expiresIn = response?.authenticationResult?.expiresIn?.toLong() ?: 0
val refreshedUserPoolTokens = CognitoUserPoolTokens(
idToken = response?.authenticationResult?.idToken,
accessToken = response?.authenticationResult?.accessToken,
refreshToken = tokens.refreshToken,
refreshToken = response?.authenticationResult?.refreshToken ?: tokens.refreshToken,
expiration = Instant.now().plus(expiresIn.seconds).epochSeconds
)

Expand Down
Loading