Hi,

Thank you for contacting us! I understand that you are developing a react native mobile app and you have a Cognito user pool where you wish to only allow users to be logged in from one device at a time and if a users tries to login from a second device, the first device must be logged out from the user account.

Cognito provides AdminUserGlobalSignOut API [1] that can be used to logout a user from all devices that they are currently logged in, as an administrator. It also invalidates all refresh tokens issued to a user. The user's current access and ID tokens remain valid until their expiry. By default, access and ID tokens expire one hour after they're issued. You can use this API in a PreAuthentication Lambda trigger to logout from all the user devices before accepting a new login request from a new user device. Cognito invokes this trigger when a user attempts to sign in, allowing custom validation to accept or deny the authentication request. Kindly check out this documentation [2] for more details on Pre-authenticated Lambda trigger.

Alternatively, Cognito also has a feature to remember devices. You can use this feature to limit the number of devices that the user can be logged in at a time.

To enable this use case, we have included an extra parameter in our inputs to our post-authentication AWS Lambda function: newDeviceUsed. It is a Boolean flag that is only true if you have device remembering turned on and if the device being used to authenticate is a new device.

With this small addition, you can set a maximum for the number of devices that can be linked to a user’s account. Within your post-authentication Lambda hook, you can call the AdminListDevices API [3] to count the number of devices currently linked if the newDeviceUsed flag is set to true. If it is over your determined limit, you fail the call, which then fails the authentication. Kindly checkout this documentation for more details [4].

I hope you find the above information useful, please feel free to reach out to us with any further queries and we'll be glad to assist!

References

• [1] https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUserGlobalSignOut.html
• [2] https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-authentication.html
• [3] https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminListDevices.html
• [4] https://aws.amazon.com/blogs/mobile/tracking-and-remembering-devices-using-amazon-cognito-your-user-pools/