Refresh token validation

Question

I receive access, id and refresh token from aws cognito. I can decode id and access token using jwt.io and also validate the signatures but for every refresh token it gives invalid signature. How can i validate the refresh token as i have to pass it in an API i created.

Mikel Del Tio · Answer

Hi,

According to [AWS documentation](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.html ), Amazon Cognito refresh tokens are encrypted, and can't be read by Amazon Cognito administrators or users, neither validate it. You should use it to get new tokens or revoke existing tokens.

Joe Melfi · Answer

In the documentation that Mikel refers to, there are details on "Storing tokens" after performing authentication with Amazon Cognito user pools. Once the authorization is complete, your application MUST be able to store the session token to allow for continued re-use until the token expires. A function for re-try and re-authentication on expiration in the application being implemented when the JWT expires. These are custom function implementation.

Refresh token validation

Add your answer

Relevant content