Add way to invalidate other sessions when the user changes their password.

[duraz0rz]

Is your feature request related to a problem? Please describe. We're implementing a custom forgot password flow on our web app and, while changing the password works fine, I would've expected other sessions to be invalidated. We have a mobile app that goes along with the web app and the mobile app stays logged in.

Describe the solution you'd like I would like a way to be able to invalidate other sessions after the user changes their password via the forgot password Auth flow. We call Auth.forgotPassword to send the user the verification code, and Auth.forgotPasswordSubmit with their username, verification code, and new password already. An additional optional parameter on forgotPasswordSubmit would be nice to indicate we want to invalidate other sessions.

Describe alternatives you've considered I considered using Auth.signOut({ global: true }), but that requires the user being signed into the app in the first place; the forgot password flow only applies when the user is already signed out on the local session in our app.

[reni11111]

@duraz0rz did u find any solution/workaround?

[s1mrankaur]

still waiting for a workaround

[elorzafe]

Sorry for the late reply, the workaround is the following

When prompting for username password and code you would have to keep on App state the username and password then you would have to call the following Auth APIs

• Auth.forgotPasswordSubmit
• Auth.signIn
• Auth.globalSignout
• Auth.signIn

We have this tracked on our backlog

Thanks for your feedback!

[jerocosio]

Hi @elorzafe, great to hear that this is being tracked on the backlog, but I think it should be prioritized as this can create a security vulnerability. The account is still open on whatever browser or device it was logged into, so there is no way for the victim to remove the attacker's access if the account has already been compromised.

[elorzafe]

@jerocosio

I think the safest way to do this would be on the Cognito API to have globalSignout flag to invalidate all the sessions for that user.

Does the workaround make sense meanwhile we don't have this feature from Cognito?

[jerocosio]

Hey @elorzafe, thanks for the quick reply. I actually use the global signout flag on my app, but I believe that even this would allow the attacker to have access at least until the refresh token expires, right? And the minimum time for the refresh tokens is 60 minutes, so the attacker could still have access for the account on this time.

[s1mrankaur]

Second @jerocosio's comment. If I recall correctly, minimum time for refresh tokens has been reduced to 5 mins but that's still not instant (short enough)

[jerocosio]

Hello @elorzafe, I'm currently sending an e-mail to my users whenever there's a password reset, I'm doing this with a Cognito trigger and a Lambda function. Is there someway that I could invalidate the tokens on this function?