Pfthb

I am using AWS API gateway for API's and cognito UserPool's for security. After Authenticating the user we will get tokens and I am using that token to authorise my API.

Now, I am trying to enable signout to cognito authorised users using javascript. Used the below code.

if (cognitoUser != null) 
 cognitoUser.globalSignOut( 
 onFailure: e => console.log(e), 
 onSuccess: r => 
 console.log('Logout success: ' + r) 
) 

I am getting response as success but still I am able to access my API with the previous tokens.Please suggest me how to inactivate all the tokens issued to that cognito user.

The id token, which API Gateway uses to authenticate API calls, stays valid for a while.

I would test for the access token. It should expire right after you call global sign out.

The key word is should above. Please see this issue. It’s an on-going struggle to get AWS to implement an immediate revocation. Here’s a relevant quote from lalithvaka on this issue:

I worked with AWS Cognito team to get this taken care and got released as a fix through CLI as following.

aws cognito-identity update-identity-pool --identity-pool-id --identity-pool-name --allow-unauthenticated-identities --cognito-identity-providers ProviderName=,ClientId=,ServerSideTokenCheck=<true|false>

By setting the ServerSideTokenCheck to true on a Cognito Identity
Pool, that Identity Pool will check with Cognito User Pools to make
sure that the user has not been globally signed out or deleted before
the Identity Pool provides an OIDC token or AWS credentials for the
user. Now we are running into another issue of this Token being cached
in API Gateway for 10mins which would let that OID token still be
active for 10mins even though the User has globally signed out.

Here's what I mean by test for the accessToken (I have had success with method #2):

1.) you could develop a custom authorizer for API Gateway;

2.) you could perform a check at the start of your lambda functions or on your servers, using:

const AWS = require('aws-sdk');
const awsConfig = require('./awsConfig');

const cognito = new AWS.CognitoIdentityServiceProvider(awsConfig);

// accessToken provided from API Gateway

new Promise((resolve, reject) => 
  cognito.getUser( accessToken , (errorCallback, response) => 
    if (errorCallback) 
      reject(errorCallback);
 else 
     resolve(response);
    
 );
);

The errorCallback and response do not matter. If you get an error, the token is invalid. If you don’t, it’s valid.