Proactively refresh tokens

[philip-zhang]

I'm using Amplify 1.8.1 for user authentication, and including access token and ID token in subsequent request headers for authorization, and it works just fine for the most part

But when there are some user info updates need be done, the backend calls AdminUpdateUserAttributes method, which would update user info as well as ID token.

So now ID token in backend changes, but from iOS client perspective, its session could still be valid, and will provide me the cached tokens. Therefore, all subsequent requests to backend will fail with HTTP code 403, until the cached tokens in iOS client expire and get refreshed.

It would be great if I can initiate the token refresh process on demand from client side. (Or are there any alternative approaches to avoid getting stuck when backend udpates user attributes?) Any help would be much appreciated!

[ruiguoamz]

Hi, @philip-zhang

I wonder what's your use case with AdminUpdateUserAttributes

With normal updateUserAttribute, this is not be an issue.

For your use case, is user re-authentication going to work? Re-authenticate means sign out and sign in the user again.

[royjit]

Proactively refreshing token is not currently supported in Auth category. We will take this as a feature request and update here when we have more info.

[philip-zhang]

I wonder what's your use case with AdminUpdateUserAttributes

Hi @ruiguoamz, thanks for responding! Using AdminUpdateUserAttributes is a decision made by our backend team. I believe the main reason is to prevent those attributes from being maliciously/accidentally updated by anyone without the right authority.

[philip-zhang]

Proactively refreshing token is not currently supported in Auth category.

Hi @royjit, thanks for responding! Actually I believe I've found a solution -- or at least a workaround -- for refreshing tokens from client side. In AWSCognitoIdentityProvider pod , AWSCognitoIdentityUser.h, there is this method

It suits my use case, and as I tested, it works perfectly. To refresh token, I just need to call clearSession before fetching session:

//Clear session to trigger force refresh if indicated
if amplifyNeedsTokenRefresh {
    amplifyNeedsTokenRefresh = false
    AWSCognitoIdentityUserPool.default().currentUser()?.clearSession()
}
//Then call `fetchAuthSession`
...

Do you think it's a proper solution? Please let me know!

[github-actions[bot]]

This issue is stale because it has been open for 14 days with no activity. Please, provide an update or it will be automatically closed in 7 days.

[royjit]

PR - https://github.com/aws-amplify/amplify-ios/pull/2141

[royjit]

Force refresh of token is now available in v2.0.0