How to Prevent AWS Cognito Tokens from Being Used in API Gateway After GlobalSignOut?

Question

Hi all,

I'm using **AWS Cognito as the authorizer for my API Gateway** endpoints. Here's my current setup:

* I generate tokens (Access, Id and Refresh tokens) using AWS SDK via InitiateAuth.
* I pass the Id Token as the bearer token when calling my APIs.
* I use the GlobalSignOut method from the AWS SDK to invalidate the tokens.

However, even after calling GlobalSignOut, the Id Token can still be used to access my API Gateway-protected routes until it expires. This raises security concerns, as a compromised token or one associated with a logged-out user can still be used to access protected APIs until it expires.

I also tried using the Access Token instead of the Id Token, but observed the same behavior — the token remains valid until its natural expiration.

My questions are:
1. Is this the **expected behavior** in AWS Cognito — that tokens remain valid until expiry even after GlobalSignOut?
2. Is there a **way to force immediate invalidation** of tokens?
3. What are the **best practices** to prevent use of invalidated tokens?

Any guidance or AWS-recommended strategies would be appreciated.

Thanks!

re:Post Agent · Answer

Yes, this is the expected behavior with AWS Cognito tokens. When you call GlobalSignOut or AdminUserGlobalSignOut, Amazon Cognito invalidates the tokens in its own systems, but this doesn't automatically invalidate JWT tokens that have already been issued and are being used with API Gateway.

Here's what happens when you call GlobalSignOut:

1. Amazon Cognito no longer accepts token-authorized user operations that use the signed-out user's access tokens.
2. The user's ID token is no longer accepted in GetId requests to an identity pool with ServerSideTokenCheck enabled.
3. Refresh tokens are no longer accepted in refresh requests.

However, API Gateway authorizers typically validate tokens locally by checking the signature and expiration without making a call back to Cognito. This is why your tokens continue to work with API Gateway until they expire naturally.

To force immediate invalidation and prevent use of invalidated tokens, you have a few options:

1. Implement server-side token validation by creating a custom authorizer for API Gateway that checks with Cognito if the token has been revoked.

2. Use shorter token expiration times to reduce the window of vulnerability after sign-out.

3. Implement a token blacklist or revocation list in your application, where you store revoked tokens and check against this list in your API authorizer.

4. Use the `/oauth2/revoke` endpoint to revoke specific refresh tokens. This endpoint revokes both the refresh token and all access and identity tokens that were issued with it.

5. For highly sensitive operations, consider requiring re-authentication or additional verification steps.

Best practice is to use a combination of these approaches based on your security requirements, with shorter token lifetimes for sensitive applications and potentially implementing server-side validation for critical endpoints.  
**Sources**  
[GlobalSignOut - Amazon Cognito User Pools](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GlobalSignOut.html)  
[AdminUserGlobalSignOut - Amazon Cognito User Pools](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUserGlobalSignOut.html)  
[The token revocation endpoint - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/revocation-endpoint.html)  
[Ending user sessions with token revocation - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/token-revocation.html)

How to Prevent AWS Cognito Tokens from Being Used in API Gateway After GlobalSignOut?

Add your answer

Relevant content