CognitoJwtVerifier verify revoked token

Question

Hello, me and my team have an issue with Cognito. When user logs out we use in Node.js globalSignOut function passing to it accessToken. We checked and it revokes a token, but the issues lies in our security handler where we use CognitoJWTVerifier, and when we pass to it revoked accessToken it does not throw an error. Is this supposed to work like so and is there a way to check if the token was revoked without using getUser and expecting to throw an error if token was revoked or caching using redis. Maybe we are missing some parameter. Thank you in advance

qinyang.wang · Answer

Hello, in [this document](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-verifying-a-jwt.html), CognitoJwtVerifier only does the following check, and does not check whether the token is revoked:

**Validate tokens with aws-jwt-verify**

In a Node.js app, AWS recommends the aws-jwt-verify library to validate the parameters in the token that your user passes to your app. With aws-jwt-verify, you can populate a CognitoJwtVerifier with the claim values that you want to verify for one or more user pools. Some of the values that it can check include the following.

* That access or ID tokens aren't malformed or expired, and have a valid signature.
* That access tokens came from the correct user pools and app clients.
* That access token claims contain the correct OAuth 2.0 scopes.
* That the keys that signed your access and ID tokens match a signing key kid from the JWKS URI of your user pools.The JWKS URI contains public information about the private key that signed your user's token. You can find the JWKS URI for your user pool at https://cognito-idp..amazonaws.com//.well-known/jwks.json.

For more information and example code that you can use in a Node.js app or a AWS Lambda authorizer, see aws-jwt-verify on GitHub.

CognitoJwtVerifier verify revoked token

Add your answer

Relevant content