(cognito): Support refresh token rotation

[sugiruu]

Describe the feature

Cognito recently released support for short-lived refresh tokens. Supporting this new feature on CDK would be a nice addition.

Docs

Release announcement

Use Case

Most OIDC clients expect refresh tokens to be short lived e.g. a new refresh token to be issue with each token refresh.

I have an application using the angular oidc client that's is failing the refresh token process, since the default behavior for cognito is to issue a long-lived refresh token.

[ERROR] - no refresh token found, please login 
[ERROR] - silent renew failed! Error: Error: no refresh token found, please login

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.1013.0

Environment details (OS name and version, etc.)

Linux 6.14.4-arch1-1

[ykethan]

Hey @sugiruu , thank you for reaching out. On diving into this property, here's what i was able to find.

The Cognito refresh token rotation property does appear to be available in the underlying CloudFormation resource (AWS::Cognito::UserPoolClient via the RefreshTokenRotation property), but it's not currently not yet available on in the AWS CDK cfnUserPoolClient L1 construct.

Of the top once available change may require an update to the UserPoolClient construct as follows

Add a new interface for refresh token rotation:

/**
 * The configuration of your app client for refresh token rotation.
 */
export interface RefreshTokenRotation {
  /**
   * The state of refresh token rotation for the current app client.
   * @default - undefined (CloudFormation defaults to DISABLED)
   */
  readonly feature?: 'ENABLED' | 'DISABLED';

  /**
   * Grace period for the original refresh token (0-60 seconds).
   * @default - undefined (CloudFormation defaults value)
   */
  readonly retryGracePeriodSeconds?: number;
}

Add the property to UserPoolClientOptions:

/**
 * Configuration for refresh token rotation
 * @see https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-refresh-token.html#using-the-refresh-token-rotation
 * @default - undefined (refresh token rotation is disabled)
 */
refreshTokenRotation?: RefreshTokenRotation;

From release history: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/ReleaseHistory.html
this was added on April 29, the cdk automation should pick this up on monday may 5.

We greatly appreciate community contributions! If you or someone else is interested in implementing this, we'd be happy to review a Pull Request. Please check our contribution guidelines before starting.

We'll leave this issue open to track the request. Meanwhile, welcome to add 👍 to help us prioritize.

[related-issues-bot-for-aws]

Hi @sugiruu,

Thanks for opening this issue! After reviewing the details, we found some other discussions that may be duplicates or closely related:

Potential Duplicate Issues

• (cognito): refresh token rotation unsupported #34795: Both issues request adding support for Cognito's recently released refresh token rotation feature to the CDK. They target the same AWS CDK Cognito UserPoolClient construct and reference the same underlying CloudFormation property (RefreshTokenRotation). The current issue demonstrates how OIDC clients expect refresh tokens to be short-lived with an Angular OIDC client failing with the error "[ERROR] - no refresh token found, please login", while (cognito): refresh token rotation unsupported #34795 provides additional context about handling the ALLOW_REFRESH_TOKEN_AUTH conflict. Both would be fixed by implementing the same RefreshTokenRotation property in the CDK UserPoolClient.

This message was generated automatically to help connect related conversations and improve discoverability.

If you feel this issue brings new or distinct information, feel free to add a comment to keep it open. Otherwise, we'll close this issue in 7 days if we don't recieve a response to help keep discussions consolidated.

Please react with 👍 or 👎 to let us know if this response was helpful!

Thank you for helping improve CDK! 🙌

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.