ALB + Cognito OIDC: How to Force Immediate Logout and Invalidate AWSELBAuthSessionCookie?

This documentation segment: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html#authentication-logout explains that's how it works:

To prevent users from reusing a deleted cookie, we recommend that you configure as short an expiration time for the access token as is reasonable. If a client provides the load balancer with a session cookie that has an expired access token with a non-NULL refresh token, the load balancer contacts the IdP to determine whether the user is still logged in.

In other words, just as you described, if the ALB receives a valid, non-expired access token, it will allow the request through and issue a session cookie, if one isn't present. Technically, I believe the way the ALB is implemented is it simply validates the access token cryptographically for each request, without maintaining state. That means there's no session state maintained by the ALB that could be invalidated when the user logs out.

The advice in the documentation is to set the access token lifetime as short as is appropriate for the use case and to rely on the ALB using the refresh token to check with the IdP by requesting a fresh access token that the session is still valid. The IdP should maintain state information for the logged-on sessions. For a practical instantaneous logoff experience for the user, clearing the ALB-issued token cookies should accomplish that.