Issue with SSO Session Expiry After 1 Hour Using AWS Cognito with Third-Party Integration

The issue you're experiencing with your SSO session expiring after 1 hour despite configuring longer token expiration times in AWS Cognito is likely not due to a default limitation in Cognito itself. Cognito allows for flexible configuration of token expiration times, and it's possible to set them for much longer durations.

Given that you've set the Access Token, ID Token, and Refresh Token to have longer expiry times (1 day or more) in Cognito, the 1-hour expiration you're seeing is more likely related to how the miniOrange OAuth plugin for WordPress is handling the session management or token refresh process.

Here are some potential reasons and solutions to consider:

1. Plugin Configuration: The miniOrange OAuth plugin might have its own session timeout settings that are overriding the Cognito token expiration times. Check the plugin's configuration to see if there's a session timeout setting that's set to 1 hour.

2. Token Refresh: The plugin may not be properly utilizing the refresh token to obtain new access and ID tokens before they expire. Ensure that the plugin is configured to use refresh tokens and that it's attempting to refresh the session before it expires.

3. WordPress Session Management: WordPress itself has session management features that could be interfering with the SSO session. Check your WordPress configuration for any session timeout settings.

4. Server-side Session Management: If your web server (e.g., Apache, Nginx) is configured with its own session management, it could be forcing a logout after 1 hour regardless of the Cognito token expiration times.

To address this issue:

1. Review the miniOrange OAuth plugin documentation thoroughly to ensure it's configured correctly for long-running sessions with Cognito.

2. Contact miniOrange support to inquire about how their plugin handles token refresh and session persistence with Cognito. They may have specific settings or best practices for extending session duration.

3. Implement a client-side solution to refresh the tokens periodically. This might involve using JavaScript to call a backend endpoint that refreshes the tokens using the refresh token before they expire.

4. Check your web server and WordPress configurations to ensure they're not enforcing a 1-hour session limit.

5. Consider implementing a custom solution using the AWS SDK for PHP or JavaScript to manage the Cognito authentication process directly, which would give you more control over token handling and session management.

Remember, when implementing extended session durations, it's important to balance user convenience with security considerations. Ensure that you have appropriate security measures in place, such as the ability to revoke refresh tokens if needed.

Sources
Community | Amazon Cognito - Function over form

Hello, I'm not sure how exactly the miniOrange OAuth plugin for WordPress works, however if it is using Cognito's hosted UI or federation, keep in mind that when users sign in through the hosted UI, Amazon Cognito sets session cookies that are valid for 1 hour by default. See https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-id-token.html

However, after exactly 1 hour, users are prompted to log in again when trying to access the website, indicating that the session has expired. • Access Token

I have hit a similar issue but mine isn't with Cognito. Please post your answer once you find the solution.

In your case, I am hoping Cognito has the ability to turn debug logs on ie cloudTrail or CloudWatch. If it does, I would try that and see what is in the log at 1 hour.

That said, fyi, mine is with the AWS CLI. I have seen the one hour timeout even though all appeared to be set correctly. And then finally just started working. Yeah right:-) I then increased the session and portal timeout to 12 hours and it started the one hour issue again. And then "magically" started working correctly again. I wish I knew what I did:-)

Good luck.