I’m currently facing an issue with AWS Cognito refresh tokens and would appreciate some guidance.
Problem:
I have an AWS Cognito setup where the refresh token is configured to expire after 30 days. The refresh token is used to generate new access tokens, and this process works fine for the entire duration of 30 days. However, once the refresh token expires, my protected resource calls result in ‘Invalid token’ or ‘Token has expired’ errors.
Requirement:
Is there a way to refresh the refresh token before its expiry time, similar to how we rotate the access token? Specifically, I want to understand how to:
-
Use the current access token or refresh token to refresh the refresh token within its expiry period.
-
Ensure that the refresh token is refreshed regularly to prevent expiration issues.
Additionally, I’d like to understand how platforms like Gmail manage tokens to last for long durations (e.g., months or years) without frequent manual re-authentication.
Context:
-
The refresh token has a 30-day expiry period.
-
Once expired, protected resource calls fail with ‘Invalid token’ or ‘Token has expired’ errors.
Questions:
-
Is there a built-in mechanism in AWS Cognito/Salesforce to refresh the refresh token within its expiry period?
-
How can I ensure seamless long-term authentication similar to platforms like Gmail?
Thank you for your help!
Attempts:
-
I have tried setting shorter expiry times for the access token, but the refresh token still expires after 30 days.
-
I have looked from Salesforce end also, we didn’t find any absolute solution for this.