Cognito - What to do with the Tokens

Question

I have successfully implemented the authentication flow using Cognito. I have used lambda functions to perform the authentication logic. And called the functions (via API Gateway) through my ReactJS application. Below is the process of my application's authentication flow.

The user is created from the Cognito console in AWS. And the user is sent an email with the temporary password.

1. User comes to the login screen enter the username(email) and temp password.
2. User is redirected to set a new password view (permanent password).
3. Once successful user is redirected to the login view.
4. User enters username(email) and password.
5. If successful redirected to home view (checking user has logged in has to be implemented in here)

When user login is successful, the application receives the "Access Token", "ID Token", "Refresh Token" tokens. My question is what should I do with them.
1. Should I validate the user every x amount of time with the refresh token (like send an automated request every x amount of time)?
2. If the refresh token is not valid (expired) should I automatically sign out the user?
3. What happen when the "Access Token" and "ID Token" is not valid, what should I do then?
4. If user sign out from the application, should I invalidate all 3 tokens?
5. If the user is inactive in the application (after y amount of time), should I automatically sign out the user from the application as well as from the Cognito?
6. What can I do with the "ExpiresIn" attributes that comes in the response?

I am bit unsure of what do next once those tokens are obtained. As I am new to this area, I am still trying to capture the concepts. Your explanation is much appreciated.

Accepted Answer

Hi.

The tokens you get is standard Oauth2 tokens.

The` ID Token` is proof that the user has been authenticated and contains information about the user, this token can be used by the client.  
The `Access Token` allows the client to access resources such as an API, on behalf of the user.   
The `Refresh Token` is used by the client to get a new `Access Token` without having the user to input password again.

Short, you send the `Access Token` to your API that validate the token and make a decision on allow/deny. For Example `AWS API Gateway HTTP API` comes with built in authoriser for JWT (Ouath2), which simplifies this.
You use the `Refresh Token` when your client detects that a `Access Token` is no longer valid, you can do this in different ways, checking the valid timestamp or rely on the backend to tell you the token has expired.

I would recommend reading documentation around [Oauth2](https://auth0.com/intro-to-iam/what-is-oauth-2) to get all the details and better understanding.

Hope it helps!

Cognito - What to do with the Tokens

Relevant content